Pull private git repo in Docker container

Question

I'm trying to pull a private git repo into my docker container, I added my SSHKey and script below into the Dockerfile but unfortunately with no success.

ENV SSH_KEY #SSHKey-Here#

# Configure git user
RUN git config --global user.email "developer@domain.com" && \
    git config --global user.name "Docker Image"

# Authorize SSH Host
RUN mkdir -p /root/.ssh && \
    chmod 0700 /root/.ssh && \
    ssh-keyscan gitlabdomain.com > /root/.ssh/known_hosts &&\
    chmod 644 /root/.ssh/known_hosts

# Add the keys and set permissions
RUN eval `ssh-agent -s` && \
    echo "$SSH_KEY" > /root/.ssh/id_rsa && \
    chmod 600 /root/.ssh/id_rsa

As a test I run the following command:

docker exec php-container ssh -vT git@gitlabdomain.com

I get the following errors:

OpenSSH_6.7p1 Debian-5+deb8u4, OpenSSL 1.0.1t  3 May 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to cgitlabdomain.com [xxx.xxx.x.xxx] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr umac-64-etm@openssh.com none
debug1: kex: client->server aes128-ctr umac-64-etm@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 28:3d:da:79:af:1d:28:44:d9:dc:01:55:7e:09:4b:3d
debug1: Host 'gitlabdomain.com' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:2
Warning: Permanently added the ECDSA host key for IP address '188.166.30.98' to the list of known hosts.
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: key_load_private_type: incorrect passphrase supplied to decrypt private key
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
Permission denied (publickey,password).

I've googled around and tried several suggestions but can't seem to get around these errors, i'm sure the id_rsa file actually exists with my SSHKey present in there so i don't understand why these errors are getting outputted.

Any help, advice and/or suggestions will be greatly appreciated.

Kind regards,

Lennart

What's your actual goal? You probably want to put your `Dockerfile` and/or `docker-compose.yml` in the root directory of your existing repository. You do not want to try to run git operations from in your `Dockerfile`, and you _definitely_ do not want to add your ssh private key to a Docker image (it will be there for anybody who gets the Docker image to use). — David Maze, Jul 24 '18 at 22:50
@DavidMaze My actual goal is to update all premium Wordpress plugins inside the current container, these premium plugins are present in a private repo. The Docker Image will only be for internal use and will never be pushed/published therefore I added the SSHKey in the actual dockerfile. — Epicode, Jul 26 '18 at 07:31

score 3 · Accepted Answer · edited Jul 30 '18 at 14:53

From your SSH output, it looks like you have protected your private key with a passphrase:

debug1: Trying private key: /root/.ssh/id_rsa
debug1: key_load_private_type: incorrect passphrase supplied to decrypt private key

And this password is not being supplied, so the private key cannot be used. You will need to run a ssh-add <key-file> within the container, and supply the password for authentication to succeed.

I would suggest the following improvements:

Even though your docker image is only for internal use, it is a bad idea to store ssh-keys within images on any system which is shared by multiple users. See this and this. You can instead create an image with a Dockerfile which passes in sensitive arguments:

FROM library/centos

RUN yum install -y git

ARG HOME_DIR
ARG USER_ID

RUN echo "Setting up user $USER_ID with home directory: $HOME_DIR" \
  && useradd \
    --home-dir $HOME_DIR \
    --uid 1000 \
    $USER_DIR $USER_ID \
  && touch ${HOME_DIR}/entrypoint.sh \
  && mkdir -p ${HOME_DIR}/.ssh/ \
  && chown -R ${USER_ID}:${USER_ID} ${HOME_DIR} \
  && chmod -R 700 ${HOME_DIR}/.ssh \
  && touch ${HOME_DIR}/.ssh/id_rsa \
  && chmod 400 ${HOME_DIR}/.ssh/id_rsa \
  && chmod 777 ${HOME_DIR}/entrypoint.sh

ENTRYPOINT ${HOME_DIR}/entrypoint.sh

Create an entrypoint.sh script that is passed in when running the image. This will handle all the git initialization:

# Setup Git Config
echo "Setting Git Config Values"
git config --global user.email "developer@domain.com" && \
    git config --global user.name "Docker Image"

# Setup Git Folders
echo "Adding Host Key for Github"
cd /home/my_user/ \
  && ssh-keyscan gitlabdomain.com > /home/my_user/.ssh/known_hosts

# Add ssh-key to SSH Agent
echo "Adding SSH Key to ssh-agent" \
  && eval `ssh-agent -s` && ssh-add /home/my_user/.ssh/id_rsa

# Cloning from remote repository
git clone git@gitlabdomain.com
# Prevent container from exiting
tail -f /dev/null

Then, run the container in interactive detached mode - this will allow you to attach to the container and enter the passphrase for the ssh-key.

Also mount all sensitive files as read-only volumes, and run the container as your user. This will ensure files are only able to be accessed by you:

my_user$ docker run \
  -itd \
  -e "HOME_DIR=/home/my_user" \
  -e "USER_ID=my_user" \
  -v /home/my_user/.ssh/id_rsa:/home/my_user/.ssh/id_rsa:ro \
  -v /home/my_user/entrypoint.sh:/home/my_user/entrypoint.sh \
  --user my_user \
  myimage
e4985a08a0d20f39414da801e9665abb364885052047f45e2f9943e7622c696b

Finally, attach to your container to provide the ssh-key passphrase, and detach with Ctrl-P, Ctrl-Q:

myuser$ docker attach e4985a08a0d20f39414da801e9665abb364885052047f45e2f9943e7622c696b
<enter passphrase here>
Identity added: /home/my_user/.ssh/id_rsa 
(/home/my_user/.ssh/id_rsa)
Cloning into 'my_repo'...
Warning: Permanently added the RSA host key for IP address 'xx.xxx.xxx.xxx' to the list of known hosts.
remote: Counting objects: 1014, done.
remote: Total 1014 (delta 0), reused 0 (delta 0), pack-reused 1014
Receiving objects: 100% (1014/1014), 3.48 MiB | 1.16 MiB/s, done.
Resolving deltas: 100% (512/512), done.
read escape sequence

Alternatively, if you don't want to attach/detach you can try and pass in the passphrase from a file. See this

Pull private git repo in Docker container

1 Answers1