SSH agent forwarding to Docker Alpine container from Mac OS

Question

Okay so for several projects I need to access my private repositories, so I'd like to forward the host's SSH Agent to the container to allow retrieving from these private repositories. Eventually I would like to implement this in docker-compose.

I've found a lot of answers and solutions pointing to something like this:

docker run --rm -t -i \
-v $SSH_AUTH_SOCK:/ssh-agent \
-e SSH_AUTH_SOCK=/ssh-agent \
alpine:3.6 sh

But when I run ssh-add -l inside there (after making sure openssh is installed)

I get the following error:

Error connecting to agent: Connection refused

Also tried this within my docker compose setup but it doesn't seem to work like it should. Due to most posts and solutions being several years old I hope someone can help me with accurate up-to-date info.

Answer 1

1. Add keys to the launchd managed ssh-agent:

SSH_AUTH_SOCK=`launchctl getenv SSH_AUTH_SOCK` ssh-add

2. Forward the launchd managed ssh-agent to docker container:

docker run --rm -it \
-v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock:ro \
-e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" \
image ssh hosts

The mount option and SSH_AUTH_SOCK value in container are all magic constants, do not change them.

3. launchctl getenv SSH_AUTH_SOCK may output empty string on iTerm2 3.2+ due to the bug. The work around is one of:

• A portable way for newer OS (>=10.13 i.e. macOS High Sierra) is launchctl asuser $UID launchctl getenv SSH_AUTH_SOCK, or
• For older OS, in iTerm2 > Prefs > Advanced, turn on "Enable multi-server daemon", or
• For older OS, in iTerm2 > Prefs > Advanced, turn off "Allow sessions to survive logging out and back in".

NOTE: if the launchctl problem cannot work round, there is another way to forwarding ssh agent via stdio tunnel.

Answer 2

According to this issue you can forward your macOS ssh-agent to your docker container by adding -v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock -e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" options to your docker run command, e.g.

docker run --rm -it \
-v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock \
-e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" \
docker_image