我创建了一个Docker容器,并通过shell脚本运行它,其中包含以下执行:
docker run --rm -it
--user $(id -u):$(id -g)
--network host
-e USER=$USER
-e HOME=$HOME
-h $HOSTNAME
-v /tmp:/tmp
-v /home/$USER:/home/$USER
-v ~/.ssh:/home/$USER/.ssh:ro
-e USERNAME=$USERNAME
-w /home/$USER
$IMAGE_NAME
/bin/bash
因此,我认为既不存在访问权限问题,也不存在键存在问题。但是,如果我转到我的git工作目录,这个目录之前已经用ssh克隆了。我无法验证。
git pull -v
git@mygitlab.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
打印出ssh -tv git@mygitlab.com
的输出,我看到了这些差异:无Docker容器
...
debug1: Will attempt key: /home/xxx/.ssh/id_ed25519 ED25519 SHA256:20AHxx agent
debug1: Will attempt key: gitlab ED25519 SHA256:fEqoFK agent
debug1: SSH2_MSG_EXT_INFO received
....
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/xxx/.ssh/id_ed25519 ED25519 SHA256:20AHxx agent
debug1: Authentications that can continue: publickey
debug1: Offering public key: gitlab ED25519 SHA256:fEqoFK agent
debug1: Server accepts key: gitlab ED25519 SHA256:fEqoFK agent
debug1: Authentication succeeded (publickey).
在Docker容器中:
...
debug1: Will attempt key: /home/xxx/.ssh/id_ed25519 ED25519 SHA256:20AHxx
debug1: Will attempt key: /home/xxx/.ssh/id_xmss
debug1: SSH2_MSG_EXT_INFO received
...
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/xxx/.ssh/id_rsa
debug1: Offering public key: /home/xxx/.ssh/id_ed25519 ED25519 SHA256:20AHxx
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/xxx/.ssh/id_xmss
debug1: No more authentication methods to try.
git@mygitlab.com: Permission denied (publickey).
我需要和ssh代理做点什么吗?
在这种特殊情况下,您可以通过(正如您在评论中注意到的)添加:
在docker实例中传递SSH_AUTH_SOCK
环境变量:-e SSH_AUTH_SOCK=$SSH_AUTH_SOCK
在更一般的情况下,当Docker实例中没有相同的/tmp
和/home
挂载时,这将不起作用,所以更一般地,您可能需要使用另一个ssh密钥,或者做一些更新奇的事情来传递代理通信链接。但是在这里,您运行在相同的网络空间中,在相同的文件系统上,因此让您的内部"虚拟机">1使用外部(真实)机器的ssh代理来获取私钥就足够了。
1一个Docker实例更像是一个FreeBSD的"监狱";比一个真正的虚拟机。然而,两者都提供了一种"穷人的vm"。