docker build命令使用ssh url到git repo:权限被拒绝

我正在尝试制作一个脚本，将构建一堆docker映像并将它们推送到私有存储库。

从文档来看，docker build命令似乎接受git url:确实很好。

所有的仓库都是私有的，公司里的每个人都有ssh密钥设置，可以通过ssh访问git仓库，比如git clone git@github.com:/my-org/my-repo.git

我认为提供这样的url会工作得很好，因为它似乎是一个非常常见的用例。

我在谷歌上寻找解决方案，发现了一个关于url格式的git票据，所以我尝试了以下所有内容:

ssh://git@github.com:/my-org/my-repo.git
ssh://git@github.com/my-org/my-repo.git
ssh://git@github.com:my-org/my-repo.git
git@github.com:/my-org/my-repo.git
git@github.com/my-org/my-repo.git
git@github.com:my-org/my-repo.git

这个列表中的最后一个是最有希望的，因为我得到以下输出:

$ docker build -t registry.example.com:5000/my-repo:latest --ssh=default git@github.com:my-org/my-repo.git
[+] Building 0.9s (1/1) FINISHED                                                                                                                                                             
=> ERROR [internal] load git source git@github.com:my-org/my-repo.git                                                                                                     0.9s
------                                                                                                                                                                                       
> [internal] load git source git@github.com:my-org/my-repo.git:                                                                                                                
#1 0.551 Warning: Permanently added the RSA host key for IP address '140.82.121.3' to the list of known hosts.
#1 0.896 git@github.com: Permission denied (publickey).
#1 0.898 fatal: Could not read from remote repository.
#1 0.898 
#1 0.898 Please make sure you have the correct access rights
#1 0.898 and the repository exists.
------
failed to solve with frontend dockerfile.v0: failed to read dockerfile: failed to load cache key: failed to fetch remote git@github.com:my-org/my-repo.git: exit status 128

在有人问:是的，repo存在，我可以克隆它:)

我假设"克隆"部分过程将在"当地"完成。在发送上下文供docker构建之前，使用我自己的SSH密钥。显然不是这样的。

它是一个受支持的特性吗?如果是，如何使它工作?

编辑:我意识到我忘了给出一些背景。

我在macOS上运行Docker桌面

Docker version 20.10.8, build 3967b7d

Client:
Context:    default
Debug Mode: false
Plugins:
buildx: Build with BuildKit (Docker Inc., v0.6.1-docker)
compose: Docker Compose (Docker Inc., v2.0.0-rc.3)
scan: Docker Scan (Docker Inc., v0.8.0)
Server:
Containers: 9
Running: 8
Paused: 0
Stopped: 1
Images: 28
Server Version: 20.10.8
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 1
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: io.containerd.runtime.v1.linux runc io.containerd.runc.v2
Default Runtime: runc
Init Binary: docker-init
containerd version: e25210fe30a0a703442421b0f60afac609f950a3
runc version: v1.0.1-0-g4144b63
init version: de40ad0
Security Options:
seccomp
Profile: default
Kernel Version: 5.10.47-linuxkit
Operating System: Docker Desktop
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 3.842GiB
Name: docker-desktop
ID: 77LC:Z2AY:K6AA:OXAY:3JYQ:RSSL:RCJZ:GOSK:FUTG:DAPY:WIKK:BB7A
Docker Root Dir: /var/lib/docker
Debug Mode: true
File Descriptors: 105
Goroutines: 93
System Time: 2021-09-16T08:47:27.924652162Z
EventsListeners: 4
HTTP Proxy: http.docker.internal:3128
HTTPS Proxy: http.docker.internal:3128
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
<REDACTED>
Live Restore Enabled: false

Docker for Mac不会在您的机器上本机运行，而是在虚拟机中运行。看起来git clone命令是在VirtualMachine

中执行的。我的假设是基于这个日志条目:#1 0.551 Warning: Permanently added the RSA host key for IP address '140.82.121.3' to the list of known hosts.

所以为了通过ssh访问你的私有存储库，你需要将ssh密钥对也存储在Docker的VirtualMachine中。

编辑打开终端，运行docker run -it --privileged --pid=host justincormack/nsenter1

设置--ssh=default时，是否将SSH密钥添加到正在转发的SSH -agent中?要检查，运行ssh-add -l，如果它没有显示你的密钥，然后添加ssh-add -k ~/.ssh/id_rsa

相关内容

最新更新

热门标签：