How to clone a private repository using ssh keys from inside a windows docker container?

user_10266625 0
Viewed 1850

I'm trying to setup a windows docker container from which I git pull a private container hosted on gitlab. I have ssh keys setup in the host machine that allow me to git pull said repositories. I have seen many posts on this topic, but they are all aimed at containers hosting linux or alpine images, none that work on a windows container. Here's the contents of my Dockerfile.

# syntax=docker/dockerfile:experimental
FROM mcr.microsoft.com/dotnet/framework/sdk:4.8-windowsservercore-ltsc2019

RUN Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))

RUN choco install git -params '"/GitAndUnixToolsOnPath"' -y
RUN choco install openssh --pre -y

RUN mkdir C:/Users/ContainerAdministrator/.ssh/
RUN ssh-keyscan -t rsa -H gitlab.oit.<my_institution>.edu >> C:/Users/ContainerAdministrator/.ssh/known_hosts

ARG ssh_pub_key
ARG ssh_prv_key

RUN echo $env:ssh_prv_key > C:/Users/ContainerAdministrator/.ssh/id_rsa
RUN echo $env:ssh_pub_key > C:/Users/ContainerAdministrator/.ssh/id_rsa.pub
RUN git clone git+ssh://gitlab.oit.<my_institution>.edu/<path_to_our_repo>.git

I am then building with the instruction

docker build --build-arg ssh_prv_key="$(type ~/.ssh/id_rsa)" --build-arg ssh_pub_key="$(type ~/.ssh/id_rsa.pub)" .

I also entered the container through a PowerShell window and attempted to do this line by line manually, but on the last line, I got the authenticity prompt. I thought the ssh-keyscan line was there to deal with this. That command did populate my known_hosts file with three different keys, but I still get prompted when attempting to clone.

The authenticity of host 'gitlab.oit.<my_institution>.edu (<institution’s IP Address>)' can't be established.
RSA key fingerprint is SHA256:eCKEsLv7El0SfMuHCLJ8xZohKbHetIOo18FbIDUX+78.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? fatal:

I thought the ssh-keyscan line was there to deal with this. That command did populate my known_hosts file with keys, but I still get prompted when attempting to clone. On a separate note, even if I manually type yes, which I don't want to have to do (I want this to be a portable and automated process), the git clone command does not work either with the ssh keys as I get:

 Load key "/c/Users/ContainerAdministrator/.ssh/id_rsa": invalid format.
gitlab docker ssh windows git
1 Answers

This works for me. It's a bit tricky as echo was generating UTF-16 encoding which is hard to notice at first glance, so we need to fix this:

ARG ssh_pub_key
ARG ssh_prv_key

RUN echo $env:ssh_prv_key | Out-File -encoding ASCII $env:UserProfile/.ssh/id_rsa
RUN echo $env:ssh_pub_key | Out-File -encoding ASCII $env:UserProfile/.ssh/id_rsa.pub

In my case I had to convert "\n" text to actual end of line symbols as well (note the quotes escaped to protect them from Docker processing):

ARG ssh_pub_key
ARG ssh_prv_key

RUN echo $env:ssh_prv_key.replace(\"\n\", \"`n\") | Out-File -encoding ASCII $env:UserProfile/.ssh/id_rsa
RUN echo $env:ssh_pub_key.replace(\"\n\", \"`n\") | Out-File -encoding ASCII $env:UserProfile/.ssh/id_rsa.pub
user_11165450
Related