SSH-forwarding during build only works for root

Question

Here's a Dockerfile that works:

# syntax=docker/dockerfile:1.0.0-experimental
FROM debian:buster-slim as base

# setup APT operation for noninteractive use
# This avoids a bunch of warnings like
# "debconf: unable to initialize frontend: Dialog"
ENV DEBIAN_FRONTEND=noninteractive

# install requirements
RUN apt-get update \
    && apt-get upgrade -y \
    && apt-get install -y --no-install-recommends \
        git \
        openssh-client

# add a user
# RUN adduser --disabled-password app-user
# WORKDIR /home/app-user
# USER app-user

RUN mkdir --mode=0700 ~/.ssh
RUN printf "Host <bitbucket host>\n  StrictHostKeyChecking no\n  CheckHostIP no\n" >> ~/.ssh/config
RUN chmod 600 ~/.ssh/config
RUN --mount=type=ssh ssh-keyscan -t rsa <bitbucket host> >> ~/.ssh/known_hosts
RUN chmod 600 ~/.ssh/known_hosts

RUN --mount=type=ssh git clone --no-checkout 'ssh://git@<bitbucket host>/my/project.git'

The only thing I edited out is the actual bitbucket host. Now, what doesn't work is activating the three commads following the "add a user" comment. If these three commands are activated, build fails with:

#20 [13/13] RUN --mount=type=ssh git clone --no-checkout 'ssh://git@bitbucke...
#20       digest: sha256:2ca1...
#20         name: "[13/13] RUN --mount=type=ssh git clone --no-checkout 'ssh://git@<bitbucket host>/my/project.git'"
#20      started: 2020-03-31 20:12:44.957895838 +0000 UTC
#20 0.648 Cloning into 'project'...
#20 1.170 git@<bitbucket host>: Permission denied (publickey).
#20 1.171 fatal: Could not read from remote repository.
#20 1.171 
#20 1.171 Please make sure you have the correct access rights
#20 1.171 and the repository exists.
#20    completed: 2020-03-31 20:12:46.235264455 +0000 UTC
#20     duration: 1.277368617s
#20        error: "executor failed running [/bin/sh -c git clone --no-checkout 'ssh://git@<bitbucket host>/my/project.git']: exit code: 128"

rpc error: code = Unknown desc = executor failed running [/bin/sh -c git clone --no-checkout 'ssh://git@<bitbucket host>/my/project.git']: exit code: 128

Is this a bug in Docker? Am I missing an implication that this is not supposed to work somehow? Do I need to set up an additional level of forwarding between the root account and the new user account? How does git/ssh establish the communication to the agent in the first place? I checked /tmp, /run, mounts and the environment but couldn't find a pipe/socket.

The obvious workaround is to clone as root and then run chown -R on it, but that that seems very unelegant. Also, I'd obviously like to understand what's going on.

Answer 1

Buildkit--mount=type=ssh指令将主机的 ssh 代理套接字重新安装到具有特定权限的容器中。默认值归 root (uid=0, gid=0) 所有，其他任何用户都无法读取 (mode=0600)。

您可以添加一个选项，使套接字由某些已知的非 root 用户拥有：

# When you create the user specify its uid
RUN adduser --disabled-password --uid 999 app-user
USER app-user

# Also specify the uid as a mount option
RUN --mount=type=ssh,uid=999 ssh-keyscan ...

您还可以让其他用户访问该套接字（不是一个巨大的安全问题，因为它只能在单个RUN命令的生命周期内访问，并且您可以控制它正在运行的内容）

RUN --mount=type=ssh,mode=0666 ssh-keyscan ...