"RUN --mount=type=ssh" only accessible to root

[rmoriz]

(as reported in docker/cli#1419 (comment))

The ssh socket is owned and accessibly by root only, e.g.

# syntax=docker/dockerfile:1.0.0-experimental
FROM alpine
RUN apk add --no-cache openssh-client \
   && adduser -h /example -S example example

# we are now switching to our new user and trying to access the SSH_AUTH_SOCK to list all available identities
USER example
RUN --mount=type=ssh ssh-add -l

#8 [3/3] RUN --mount=type=ssh ssh-add -l
#8       digest: sha256:b08486fd10670778bf8ca6bdc0f5950c74035d5c7f458ad24c381b7652ce1dd2
#8         name: "[3/3] RUN --mount=type=ssh ssh-add -l"
#8      started: 2018-12-21 17:24:51.397207862 +0000 UTC
#8 2.410 Error connecting to agent: Permission denied
#8    completed: 2018-12-21 17:24:54.266487196 +0000 UTC
#8     duration: 2.869279334s
#8        error: "executor failed running [/bin/sh -c ssh-add -l]: exit code: 2"

(Docker version 18.09.0, build 4d60db4)

IMHO there should be an option either to specify the uid/gid of the socket or the file mode. If this cannot be achived due to other issues, please add a note to the documentation and clarify that only root users can access the socket until further notice. Thanks!

[thaJeztah]

Thanks for reporting!

[tonistiigi]

Added in #767, use #syntax=docker/dockerfile-upstream:master-experimental to test

[jasonnoble]

If I switch users in the Dockerfile, it fails.

I'm running Docker version 18.09.2, build 6247962 on OS X 10.14.4. How do I determine if the fixes in #767 are in the build I'm running?

#syntax=docker/dockerfile-upstream:master-experimental
FROM alpine
RUN apk add --no-cache openssh-client \
   && adduser -h /example -S example example

# we are now switching to our new user and trying to access the SSH_AUTH_SOCK to list all available identities
USER example
RUN --mount=type=ssh ssh-add -L

$ export DOCKER_BUILDKIT=1
$ docker build --ssh default .
[+] Building 3.5s (10/10) FINISHED
 => [internal] load .dockerignore                                                                                                                                                                                                 0.1s
 => => transferring context: 34B                                                                                                                                                                                                  0.0s
 => [internal] load build definition from Dockerfile                                                                                                                                                                              0.0s
 => => transferring dockerfile: 37B                                                                                                                                                                                               0.0s
 => resolve image config for docker.io/docker/dockerfile-upstream:master-experimental                                                                                                                                             0.8s
 => CACHED docker-image://docker.io/docker/dockerfile-upstream:master-experimental@sha256:10994fbf22d75008bfe6fdd57abe2d5a8cef410f8e3b94768fddc11366005ccb                                                                        0.0s
 => [internal] load build definition from Dockerfile                                                                                                                                                                              0.0s
 => => transferring dockerfile: 37B                                                                                                                                                                                               0.0s
 => [internal] load .dockerignore                                                                                                                                                                                                 0.0s
 => [internal] load metadata for docker.io/library/alpine:latest                                                                                                                                                                  0.0s
 => [1/3] FROM docker.io/library/alpine                                                                                                                                                                                           0.0s
 => CACHED [2/3] RUN apk add --no-cache openssh-client    && adduser -h /example -S example example                                                                                                                               0.0s
 => ERROR [3/3] RUN --mount=type=ssh ssh-add -L                                                                                                                                                                                   0.8s
------
 > [3/3] RUN --mount=type=ssh ssh-add -L:
#9 0.630 Error connecting to agent: Permission denied
------
rpc error: code = Unknown desc = executor failed running [/bin/sh -c ssh-add -L]: exit code: 2

[rmoriz]

@jasonnoble

#syntax=docker/dockerfile-upstream:master-experimental
FROM alpine
RUN apk add --no-cache openssh-client \
   && adduser -u 100 -h /example -S example example

USER example
RUN --mount=type=ssh,uid=100 ssh-add -L

(UID 100 should be the default on Alpine for a system user. The mount uid has to be specified because it defaults to root/0. Of course you can do the trick with mode or guid or a combination, e.g. RUN --mount=type=ssh,mode=741,uid=100,gid=102)

[jasonnoble]

Thanks @rmoriz.

Allow any user in the build container to access SSH_AUTH_SOCK:

#syntax=docker/dockerfile-upstream:master-experimental
FROM alpine

ARG user_id=${UID:-194661}

RUN apk add --no-cache openssh-client \
   && adduser -u $user_id -h /example -S example example

# we are now switching to our new user and trying to access the SSH_AUTH_SOCK to list all available identities
USER example
RUN --mount=type=ssh,mode=555 ssh-add -L

[rmoriz]

@jasonnoble that's pretty insecure. And your UID default also does not match Alpine's default