git在Docker容器上使用私钥的权限被拒绝



我创建了一个Docker容器,并通过shell脚本运行它,其中包含以下执行:

docker run --rm -it 
--user $(id -u):$(id -g) 
--network host 
-e USER=$USER 
-e HOME=$HOME 
-h $HOSTNAME 
-v /tmp:/tmp 
-v /home/$USER:/home/$USER 
-v ~/.ssh:/home/$USER/.ssh:ro 
-e USERNAME=$USERNAME 
-w /home/$USER 
$IMAGE_NAME 
/bin/bash

因此,我认为既不存在访问权限问题,也不存在键存在问题。但是,如果我转到我的git工作目录,这个目录之前已经用ssh克隆了。我无法验证。

git pull -v
git@mygitlab.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.

打印出ssh -tv git@mygitlab.com的输出,我看到了这些差异:无Docker容器

...
debug1: Will attempt key: /home/xxx/.ssh/id_ed25519 ED25519 SHA256:20AHxx agent
debug1: Will attempt key: gitlab ED25519 SHA256:fEqoFK agent
debug1: SSH2_MSG_EXT_INFO received
....
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/xxx/.ssh/id_ed25519 ED25519 SHA256:20AHxx agent
debug1: Authentications that can continue: publickey
debug1: Offering public key: gitlab ED25519 SHA256:fEqoFK agent
debug1: Server accepts key: gitlab ED25519 SHA256:fEqoFK agent
debug1: Authentication succeeded (publickey).

在Docker容器中:

...
debug1: Will attempt key: /home/xxx/.ssh/id_ed25519 ED25519 SHA256:20AHxx
debug1: Will attempt key: /home/xxx/.ssh/id_xmss 
debug1: SSH2_MSG_EXT_INFO received
...
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/xxx/.ssh/id_rsa
debug1: Offering public key: /home/xxx/.ssh/id_ed25519 ED25519 SHA256:20AHxx
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/xxx/.ssh/id_xmss
debug1: No more authentication methods to try.
git@mygitlab.com: Permission denied (publickey).

我需要和ssh代理做点什么吗?

这种特殊情况下,您可以通过(正如您在评论中注意到的)添加:

在docker实例中传递SSH_AUTH_SOCK环境变量:
-e SSH_AUTH_SOCK=$SSH_AUTH_SOCK 

在更一般的情况下,当Docker实例中没有相同的/tmp/home挂载时,这将不起作用,所以更一般地,您可能需要使用另一个ssh密钥,或者做一些更新奇的事情来传递代理通信链接。但是在这里,您运行在相同的网络空间中,在相同的文件系统上,因此让您的内部"虚拟机">1使用外部(真实)机器的ssh代理来获取私钥就足够了。


1一个Docker实例更像是一个FreeBSD的"监狱";比一个真正的虚拟机。然而,两者都提供了一种"穷人的vm"。

相关内容

  • 没有找到相关文章