Solved

Win11 -> WSL2 -> devcontainer ssh-add not accessible anymore

Forum|Forum|1 year ago
June 18, 2025
8 replies
1586 views

Hi all,

I'm working on Windows 11 Pro, where 1 Password in the latest stable version is installed. I have WSL2 enabled with Ubuntu 24.04 installed and inside there I have docker installed to run devcontainers for VS Code. In 1Password I have all my ssh keys to interact with git and I have the ssh-agent option enabled.

On Windows I can see all my keys in a terminal when executing ssh-add -l. In WSL I can also see all keys when executing ssh-add.exe -l and when opening a cloned repository in WSL in VS Code, the authentication works fine. (I love it).

Now up until a couple days ago, I could also open a repository which has been cloned into WSL inside a devcontainer and the ssh agent forwarding was working like a charm, I could even sign commits, I have no clue how this magic works, but I loved it. Then it stopped working and I can't figure out why.

Of course, all involved tools (Windows, WSL, VSCode, 1Password, etc.) install updates in the background, so it could be due to this. I disabled and enabled the 1Password ssh agent in the settings, no difference. I recreated the WSL instance, no difference. I reinstalled 1Password. In the VSCode devcontainer extension is the option to forward services, that is still checked, I tried toggling that as well. In WSL I still see the keys via ssh-add -l, but when I do the same inside a devcontainer I only see:

Could not open a connection to your authentication agent.

When I check the value of $SSH_AUTH_SOCK it is empty in both WSL and devcontainer, should it have a value? In the 1Password help around this topic I couldn't find it mentioned anymore.

If this setup is still working for someone else, could you please check the value of this variable and post it?

Best answer by bjoernb

Thanks for triggering this issue, it's the VS Code update, downgrading VS Code solves it for me. To be tracked here: https://github.com/microsoft/vscode/issues/251456

So for future reference: On the Windows host, the 1Password ssh agent has to be activated in the settings of 1Password. gitconfig should be extended and aliases in WSL should be created, like mentioned here: https://developer.1password.com/docs/ssh/integrations/wsl

That's it, then ssh keys from 1Password on Windows should be accessible in Windows, WSL and inside devcontainers. In WSL the SSH_AUTH_SOCK variable is empty. When starting a devcontainer, VSCode will create a socket and this should be visible in the logs (F1 > Dev Containers: Show Container Log)

[886954 ms] Start: Launching Dev Containers helper.
[886955 ms] ssh-agent: SSH_AUTH_SOCK not set on wsl host.
[886955 ms] ssh-agent: SSH_AUTH_SOCK not set on local host.
[886955 ms] ssh-agent: SSH_AUTH_SOCK in container (/tmp/vscode-ssh-auth-19e6a8e3-90b7-4bf3-bb6f-98aa4e871c30.sock) forwarded to local host (\\.\pipe\openssh-ssh-agent).

Even commit signing will work with this infrastructure in Windows, WSL and devcontainer. It's pretty awesome when it works.

A

ajm1811

Hi bjoernb - I've been using this setup for about 3 years and it's worked great. However, I concur - a few days ago this stopped working for me too. I notice 1Password updated about a week ago but I think it's been working for me since then. But I also noticed that a new release of the vscode devcontainers extension was shipped on 12th June and my extension updated on the 16th which I think is about the time it stopped working for me.

EDIT - can confirm that the issue is with the devcontainers extension v0.417.0. If I downgrade that extension back to v0.413.0 (via the uninstall>>install specific version menu on the extension itself) then it's working again.

Release notes of v0.417.0 suggest some addition of a feature allowing you to add an ssh pre-connection script so could be something to do with that.

J

james-henson

Thank you for posting @bjoernb and @ajm1811 . The setup stopped working a couple of days ago for me too. Downgrading the devcontainer extension to v0.413.0 did not solve the problem unfortunately. Perhaps I have misconfigured something after reinstalling WSL2, Git and VSCode.

I can connect in WSL2 and via CMD but not in the devcontainer.

ssh-add.exe -l works in WSL and CMD.

`echo $SSH_AUTH_SOCK` shows nothing is set.

Could you please share your configuration, or let me know if you see something wrong in my configuration to sign commits in the devcontainer using SSH?

My configuration

Windows 11 Pro

PS C:\Users\11> wsl -v
WSL version: 2.5.9.0
Kernel version: 6.6.87.2-1
WSLg version: 1.0.66
MSRDC version: 1.2.6074
Direct3D version: 1.611.1-81528511
DXCore version: 10.0.26100.1-240331-1435.ge-release
Windows version: 10.0.26100.4349

Git (Windows)

PS C:\Users\11> git -v
git version 2.50.0.windows.1

"C:\Users\name\.gitconfig"

[core]
  sshCommand = C:/Windows/System32/OpenSSH/ssh.exe

[user]
  name = Firstname Lastname
  email = contact@name.com
  signingkey = ssh-ed25519 ....

[commit]
  gpgsign = true

[gpg]
  format = ssh

"C:\Users\11\.ssh"

/1password/config

# This config file and the *.pub files in this folder are automatically
# generated and managed by 1Password. Any manual edits to this file or
# any *.pub file will be lost.
#
# You can include this file in your main SSH config by adding the
# following line to your ~/.ssh/config file:
#
#   Include ~/.ssh/1Password/config

Match all

/config

VScode

PS C:\Users\11> code --list-extensions --show-versions
github.github-vscode-theme@6.3.5
github.vscode-github-actions@0.27.2
github.vscode-pull-request-github@0.110.0
ms-vscode-remote.remote-containers@0.413.0
quarto.quarto@1.123.0

WSL 2

PS C:\Users\11> wsl --status
Default Distribution: Ubuntu
Default Version: 2

`"\\wsl.localhost\Ubuntu\home\username\.bashrc"

# use the 1Password SSH agent on your Windows host to authenticate SSH requests other than Git (see https://developer.1password.com/docs/ssh/integrations/wsl)
alias ssh='ssh.exe'
alias ssh-add='ssh-add.exe'

Git

name@laptop:~$ git -v
git version 2.49.0

"\\wsl.localhost\Ubuntu\home\username\.gitconfig"

[core]
	sshCommand = ssh.exe

[user]
  name = Firstname Lastname
  email = contact@name.com
  signingkey = ssh-ed25519 ....

[gpg]
  format = ssh

[commit]
  gpgsign = true

Devcontainer

// For format details, see https://aka.ms/devcontainer.json. For config options, see the
// README at: https://github.com/devcontainers/templates/tree/main/src/javascript-node
{
	"name": "Node.js",
	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
	"image": "mcr.microsoft.com/devcontainers/javascript-node:1-22-bookworm",

	// Features to add to the dev container. More info: https://containers.dev/features.
	// "features": {},

	// Use 'forwardPorts' to make a list of ports inside the container available locally.
	// "forwardPorts": [],

	// Use 'postCreateCommand' to run commands after the container is created.
	"postCreateCommand": "sudo apt update && sudo apt upgrade"

	// Configure tool-specific properties.
	// "customizations": {},

	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
	// "remoteUser": "root"
}

### Git config is copied into devcontainer

[user]
  name = Firstname Lastname
  email = contact@name.com
  signingkey = ssh-ed25519 ....

[gpg]
  format = ssh

[commit]
  gpgsign = true
[credential]
	helper = "!f() { /home/node/.vscode-server/bin/dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1/node /tmp/vscode-remote-containers-ccfd55fa-f7d0-49e1-aad7-ef98b1b25a1c.js git-credential-helper $*; }; f"

.gitconfig (in devcontainer)

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true

# Terminal Environment Changes

## Extension: vscode.git

Enables the following features: git auth provider

- `GIT_ASKPASS=/vscode/vscode-server/bin/linux-x64/dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1/extensions/git/dist/askpass.sh`
- `VSCODE_GIT_ASKPASS_NODE=/vscode/vscode-server/bin/linux-x64/dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1/node`
- `VSCODE_GIT_ASKPASS_EXTRA_ARGS=`
- `VSCODE_GIT_ASKPASS_MAIN=/vscode/vscode-server/bin/linux-x64/dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1/extensions/git/dist/askpass-main.js`
- `VSCODE_GIT_IPC_HANDLE=/tmp/user/1000/vscode-git-2a1fd16ae3.sock`

ssh -vT git@github.com causes the container to hang and then reload.

[239979 ms] Start: Run in container: # Test for /home/node/.gitconfig and git
[240009 ms] 
[240010 ms] 
[240013 ms] Start: Run in container: # Copy /home/name/.gitconfig to /home/node/.gitconfig
[240054 ms] 
[240055 ms] 
[240099 ms] Start: Run in container: # Cleaning up git config
[240156 ms] Removing Git config key: core.sshCommand = ssh.exe
[240157 ms] 
[240166 ms] Start: Run in Host: git config --global --get gpg.ssh.allowedSignersFile
[240172 ms] Start: Run in container: command -v git >/dev/null 2>&1 && git config --global --replace-all credential.helper '!f() { /home/node/.vscode-server/bin/dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1/node /tmp/vscode-remote-containers-ccfd55fa-f7d0-49e1-aad7-ef98b1b25a1c.js git-credential-helper $*; }; f' || true
[240204 ms] 
[240205 ms] 
[240213 ms] Start: Run in Host: docker rm -f 9349da6b00183f26bca9531de411c935ceb374a4d4d3a5e6cfae23a1bbda86b7
[445183 ms] Start: Run in container: cat /proc/6785/environ
[550748 ms] Port forwarding connection from 50224 > 35601 > 35601 in the container.
[550749 ms] Start: Run in Host: docker exec -i -u node -e VSCODE_REMOTE_CONTAINERS_SESSION=bce06510-fbe3-4299-98a1-5cfc3ab7418c1750351652939 41fceeb8dc0b4fe0299f5ca01a294293cadf5aa9e0ce68e89621bce8682fcb92 /home/node/.vscode-server/bin/dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1/node -e 
[552063 ms] Start: Reconnection attempt 1
[552064 ms] Start: Reconnecting CLIHost without ExecServer.
[552065 ms] Start: Host: Reconnecting Dev Container server
[552066 ms] Start: Run: wsl -d Ubuntu -e /bin/sh -c cd '/home/name' && /bin/sh
[552100 ms] unexpected end of parent stream
[552108 ms] Container server did not launch or terminated: Error: unexpected end of parent stream
        at Ui.destroy (c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:26642)
        at Ui.write (c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:27383)
        at source (c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:29289)
        at c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:29835
        at c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:20397
        at Socket.a (c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:17:4611)
        at Socket.emit (node:events:518:28)
        at Pipe.<anonymous> (node:net:351:12)
[552109 ms] unexpected end of parent stream
[552110 ms] Port forwarding 52530 > 35601 > 35601 terminated with error: unexpected end of parent stream
[552112 ms] Port forwarding 52531 > 35601 > 35601 terminated with error: unexpected end of parent stream
[552113 ms] Keep-alive process ended.
[552121 ms] Port forwarding 52530 > 35601 > 35601: Local close
[552122 ms] Host server terminated (code: null, signal: SIGKILL).
[552123 ms] Host server terminated early. Not reconnecting.
[552127 ms] Port forwarding 52531 > 35601 > 35601: Local close
[552636 ms] Start: Container: Reconnecting Dev Container server
[552638 ms] Start: Run in Host: docker exec -i -u node 41fceeb8dc0b4fe0299f5ca01a294293cadf5aa9e0ce68e89621bce8682fcb92 /bin/sh
[552685 ms] Start: Run in Host: docker inspect --type container 41fceeb8dc0b4fe0299f5ca01a294293cadf5aa9e0ce68e89621bce8682fcb92
[587846 ms] Start: Reconnection attempt 2
[587848 ms] Start: Reconnecting CLIHost without ExecServer.
[587848 ms] Start: Host: Reconnecting Dev Container server
[587850 ms] Start: Run: wsl -d Ubuntu -e /bin/sh -c cd '/home/name' && /bin/sh
[587976 ms] Container server did not launch or terminated: Error: unexpected end of parent stream
        at Ui.destroy (c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:26642)
        at Ui.write (c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:27383)
        at source (c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:29289)
        at c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:29835
        at c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:14:20397
        at Socket.a (c:\Users\11\.vscode\extensions\ms-vscode-remote.remote-containers-0.413.0\dist\extension\extension.js:17:4611)
        at Socket.emit (node:events:518:28)
        at Pipe.<anonymous> (node:net:351:12)
[587986 ms] Host server terminated (code: null, signal: SIGKILL).
[587987 ms] Host server terminated early. Not reconnecting.
[588342 ms] Start: Container: Reconnecting Dev Container server
[588343 ms] Start: Run in Host: docker exec -i -u node 41fceeb8dc0b4fe0299f5ca01a294293cadf5aa9e0ce68e89621bce8682fcb92 /bin/sh
[588382 ms] Start: Run in Host: docker inspect --type container 41fceeb8dc0b4fe0299f5ca01a294293cadf5aa9e0ce68e89621bce8682fcb92

B

bjoernbAuthor

I have similar configs and versions everywhere and I'm facing the same situation like you, I have downgraded both the devcontainer extension (413 and one or two version older) and also tried downgrading the remote-ssh extension, but it still doesn't work. I installed different versions, stopped wsl, started it again, deleted all containers and images and rebuilt the devcontainer, still broken.

manski

I, too, have this problem. Used to work a couple of days ago. Downgrading the extension did not help in my case. I even rebuilt the devcontainer (without cache) - still not working.

manski

On a hunch, I tried to call "ssh-add -l" directly on WSL (Ubuntu) - and it's not working there either. So, for me at least, it seems 1Password no longer works with WSL.

$ ssh-add -l
Could not open a connection to your authentication agent.

And "SSH_AUTH_SOCK" is empty, too.

Calling "ssh-add -l" on Windows, however, works fine.

B

bjoernbAuthor

Do you still have the alias in your bashrc? check james-hensons post below about `"\\wsl.localhost\Ubuntu\home\username\.bashrc"

manski

No, I don't have an alias. This would solve the problem for WSL but not for the DevContainers (as the DevContainers don't use the Ubuntu WSL distro).

manski

Next tidbit of information:

It works in WSL if I run "ssh-add.exe -l" - but not if I run "ssh-add -l".

B

bjoernbAuthor

For now I have reverted back to the old solution with npiperelay. I can execute git pull again and even sign commits properly, so at least I'm unblocked.

https://gist.github.com/WillianTomaz/a972f544cc201d3fbc8cd1f6aeccef51

The good thing is, the changes are minimal, so switching between this and the "native" solution is quick, so if anybody still has suggestions how to fix properly this, please let me know.

manski

I've created an issue for the DevContainer extension: https://github.com/microsoft/vscode-remote-release/issues/11041

Let's see how this goes.

B

bjoernbAuthorAnswer

Thanks for triggering this issue, it's the VS Code update, downgrading VS Code solves it for me. To be tracked here: https://github.com/microsoft/vscode/issues/251456

So for future reference: On the Windows host, the 1Password ssh agent has to be activated in the settings of 1Password. gitconfig should be extended and aliases in WSL should be created, like mentioned here: https://developer.1password.com/docs/ssh/integrations/wsl

That's it, then ssh keys from 1Password on Windows should be accessible in Windows, WSL and inside devcontainers. In WSL the SSH_AUTH_SOCK variable is empty. When starting a devcontainer, VSCode will create a socket and this should be visible in the logs (F1 > Dev Containers: Show Container Log)

[886954 ms] Start: Launching Dev Containers helper.
[886955 ms] ssh-agent: SSH_AUTH_SOCK not set on wsl host.
[886955 ms] ssh-agent: SSH_AUTH_SOCK not set on local host.
[886955 ms] ssh-agent: SSH_AUTH_SOCK in container (/tmp/vscode-ssh-auth-19e6a8e3-90b7-4bf3-bb6f-98aa4e871c30.sock) forwarded to local host (\\.\pipe\openssh-ssh-agent).

Even commit signing will work with this infrastructure in Windows, WSL and devcontainer. It's pretty awesome when it works.

manski

~~The problem seem to be fixed in the newest VSCode version (1.101.2).~~

Update: No true. Just worked by chance. I'm trying this tip for now: https://github.com/microsoft/vscode-remote-release/issues/11043#issuecomment-3005677524

My configuration

Windows 11 Pro

Git (Windows)

"C:\Users\11\.ssh"

VScode

WSL 2

Git

Devcontainer

### Git config is copied into devcontainer

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO

Scanning file for viruses.

This file cannot be downloaded