Docker --ssh default Permission denied (publickey)

Question

I am trying to build a docker image with --ssh default on MacOS but it is not working. The same build work on Linux.

//Dockerfile

#syntax=docker/dockerfile:experimental
FROM node:16

WORKDIR /app

RUN chown -R node.node /app

RUN mkdir ~/.ssh/ && ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts

RUN --mount=type=ssh git clone git+ssh://[email protected]/account_name/repo.git

CMD tail -f /dev/null

When I run

docker build --ssh default -t my_image .

I get the error:

[email protected]: Permission denied (publickey)
fatal: Could not read from remote repository

I have my ssh key in ~/.ssh/id_rsa on my local machine and it is working outside docker.

If I try to run in the Dockerfile:

RUN --mount=type=ssh cat ~/.ssh/id_rsa

I get the error:

cat: /root/.ssh/id_rsa No such file or directory

Answer 1

Docker is not copying the file from ~/.ssh/.

When using the default configuration --ssh default you need to add your keys to your local SSH agent.

You can check ssh-add -L locally to see if the public keys are visible to the agent.

If they are not, try to run ssh-add -K.

References:

https://medium.com/@tonistiigi/build-secrets-and-ssh-forwarding-in-docker-18-09-ae8161d066

https://apple.stackexchange.com/questions/254468/macos-sierra-doesn-t-seem-to-remember-ssh-keys-between-reboots

Answer 2

Just a small update to the previous answer.

On the Mac ssh-add -K is deprecated, so use ssh-add --apple-use-keychain instead