我可以使用 Docker buildkit 向非 root 用户提供 ssh 密钥吗？

Question

RUN --mount=type=ssh我在以非 root 用户身份使用 buildkit 时遇到了麻烦。

使用这个命令：

eval $(ssh-agent)
ssh-add ~/.ssh/id_ed25519
DOCKER_BUILDKIT=1 docker build --ssh default=${SSH_AUTH_SOCK} .

还有这个 Dockerfile：

FROM docker.io/apache/airflow
USER root
RUN apt update && apt install -y git openssh-client

# uncommenting this breaks it
#USER airflow

RUN mkdir -m 700 ~/.ssh
RUN ssh-keyscan github.com > ~/.ssh/known_hosts
RUN --mount=type=ssh ssh -vvvT git@github.com

有用。我得到的输出如下：

 > [5/5] RUN --mount=type=ssh ssh -vvvT git@github.com:
...
#8 0.931 debug1: Will attempt key: matt@ChoedanKal ED25519 SHA256:2IGNbnSt122LtFaH5Z6u5eQf9B+aG0khsfNUxOKfHJU agent
#8 0.931 debug1: Will attempt key: /root/.ssh/id_rsa
#8 0.931 debug1: Will attempt key: /root/.ssh/id_dsa
#8 0.931 debug1: Will attempt key: /root/.ssh/id_ecdsa
#8 0.931 debug1: Will attempt key: /root/.ssh/id_ecdsa_sk
#8 0.931 debug1: Will attempt key: /root/.ssh/id_ed25519
#8 0.931 debug1: Will attempt key: /root/.ssh/id_ed25519_sk
#8 0.931 debug1: Will attempt key: /root/.ssh/id_xmss
#8 0.917 debug2: pubkey_prepare: done
#8 0.917 debug3: send packet: type 5
#8 0.961 debug3: receive packet: type 7
...
#8 1.056 debug1: Offering public key: matt@ChoedanKal ED25519 SHA256:2IGNbnSt122LtFaH5Z6u5eQf9B+aG0khsfNUxOKfHJU agent
#8 1.056 debug3: send packet: type 50
#8 1.056 debug2: we sent a publickey packet, wait for reply
#8 1.111 debug3: receive packet: type 60
#8 1.111 debug1: Server accepts key: matt@ChoedanKal ED25519 SHA256:2IGNbnSt122LtFaH5Z6u5eQf9B+aG0khsfNUxOKfHJU agent
#8 1.111 debug3: sign_and_send_pubkey: ED25519 SHA256:2IGNbnSt122LtFaH5Z6u5eQf9B+aG0khsfNUxOKfHJU
#8 1.111 debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:2IGNbnSt122LtFaH5Z6u5eQf9B+aG0khsfNUxOKfHJU
#8 1.122 debug3: send packet: type 50
#8 1.176 debug3: receive packet: type 52
#8 1.176 debug1: Authentication succeeded (publickey).
#8 1.176 Authenticated to github.com ([140.82.113.3]:22).
...
#8 1.271 Hi MatrixManAtYrService! You've successfully authenticated, but GitHub does not provide shell access.

但如果我包含该USER airflow行，它就会中断：

 > [5/5] RUN --mount=type=ssh ssh -vvvT git@github.com:
...
#8 0.941 debug1: pubkey_prepare: ssh_get_authentication_socket: Permission denied
#8 0.941 debug1: Will attempt key: /home/airflow/.ssh/id_rsa
#8 0.941 debug1: Will attempt key: /home/airflow/.ssh/id_dsa
#8 0.941 debug1: Will attempt key: /home/airflow/.ssh/id_ecdsa
#8 0.941 debug1: Will attempt key: /home/airflow/.ssh/id_ecdsa_sk
#8 0.941 debug1: Will attempt key: /home/airflow/.ssh/id_ed25519
#8 0.941 debug1: Will attempt key: /home/airflow/.ssh/id_ed25519_sk
#8 0.941 debug1: Will attempt key: /home/airflow/.ssh/id_xmss
#8 0.941 debug2: pubkey_prepare: done
#8 0.941 debug3: send packet: type 5
#8 0.991 debug3: receive packet: type 7
#8 0.991 debug1: SSH2_MSG_EXT_INFO received
#8 0.991 debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa>
#8 1.042 debug3: receive packet: type 6
#8 1.042 debug2: service_accept: ssh-userauth
#8 1.042 debug1: SSH2_MSG_SERVICE_ACCEPT received
#8 1.042 debug3: send packet: type 50
#8 1.092 debug3: receive packet: type 51
#8 1.092 debug1: Authentications that can continue: publickey
#8 1.092 debug3: start over, passed a different list publickey
...
#8 1.092 git@github.com: Permission denied (publickey).

这或许就是问题的关键：

ssh_get_authentication_socket: Permission denied

我想在命令中引用该键，例如：

pip install git+ssh://git@github.com/someuser/somerepo.git

这是一个问题，因为pip不建议以 root 身份调用。我已经能够通过以 root 身份创建虚拟环境、以 root 身份安装软件包，然后将虚拟环境连接到气流来解决chown -R这个问题，但我想知道是否有更直接的方法。

Answer 1

事实证明，buildkit 的--mount语法需要一个uid=参数。

所以我能够发现我的非 root 用户的 uid，如下所示：

$ docker run -it --rm apache/airflow bash -c 'id -u $(whoami)'
    50000

然后调整我的 Dockerfile 以将套接字安装到 ssh 代理，并以该 uid 作为所有者：

FROM docker.io/apache/airflow
USER root
RUN apt update && apt install -y git openssh-client && rm -rf /var/lib/apt/lists/*
USER airflow
RUN mkdir -m 700 ~/.ssh
RUN ssh-keyscan github.com > ~/.ssh/known_hosts
RUN --mount=type=ssh,uid=50000 ssh -vvvT git@github.com

此后，我能够以非 root 用户身份使用外部提供的密钥通过 ssh 进行身份验证。