[Feature Request] Using 1P SSH from inside a local Docker container

floris_1P can you help me with this? - this is in docker for mac - followed all steps here https://developer.1password.com/docs/ssh/agent/compatibility/#ssh-auth-sock

However, this works great.

export SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock
docker run -v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock -e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock" alpine sh -c 'apk add openssh && ssh-add -l'


fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/main/aarch64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/community/aarch64/APKINDEX.tar.gz
(1/10) Installing openssh-keygen (9.1_p1-r2)
(2/10) Installing ncurses-terminfo-base (6.3_p20221119-r0)
(3/10) Installing ncurses-libs (6.3_p20221119-r0)
(4/10) Installing libedit (20221030.3.1-r0)
(5/10) Installing openssh-client-common (9.1_p1-r2)
(6/10) Installing openssh-client-default (9.1_p1-r2)
(7/10) Installing openssh-sftp-server (9.1_p1-r2)
(8/10) Installing openssh-server-common (9.1_p1-r2)
(9/10) Installing openssh-server (9.1_p1-r2)
(10/10) Installing openssh (9.1_p1-r2)
Executing busybox-1.35.0-r29.trigger
OK: 15 MiB in 25 packages
256 SHA256:[XXXXXX] SSH Key ED25519 M2 (ED25519)


My current docker-compose has the following:

environment:
- SSH_AUTH_SOCK='/run/host-services/ssh-auth.sock'
volumes:
- /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock


Glad to hear it ajm1811! Feel free to get in touch if there's anything else we can help you with.

Jack

Jack_P_1P - it worked!! I had to uninstall git a couple of times, delete any remaining files and then reboot before reinstalling but it's working now. Thanks so much.

Hi ajm1811:

Thanks for following up! I've done a bit more investigation into this, and have determined the cause. When VSCode deploys a devcontainer, it copies some of your dotfiles from your Windows profile into your container for a consistent experience. One of the files copied in is your ~/.gitconfig file. Because of this, any settings that are set in your Windows ~/.gitconfig file are now set in the container.

The solution for this is two separate actions to take:
- If when you installed Git for Windows, you selected "Use bundled OpenSSH" or an option to pick which SSH client wasn't available, uninstall and reinstall Git for Windows, and select "Use external OpenSSH".

- Additionally, remove the setting sshCommand = C:/Windows/System32/OpenSSH/ssh.exe from your ~/.gitconfig file in your Windows profile.

This will result in Git in the context of Windows no longer having a bundled SSH, which means it'll use the system SSH (which is supported by 1Password SSH agent). When your ~/.gitconfig is copied into the container, it won't contain the line setting the SSH command, so your container won't attempt to use an SSH it can't access.

Let me know how you get on with that!

Jack

Thanks for the reply Jack_P_1P. I'm using WSL2. Running ssh-add -l from inside the container does indeed list my key. Also ssh -T mailto:git@github.com passes as well. But when I try to clone my repo from inside the container I get this:

Any idea what I'm missing?

Hi ajm1811:

Are you using WSL2 or Hyper-V backed containers? I've just tested on my end, and I was able to use WSL2 backed containers with 1Password SSH agent. Let me know.

Jack

Did anyone get any further with this from a Windows box? I'd be really interested to know if anyone has got that to work as that's exactly what I'm trying to do. I want to develop in VSCode/devcontainers from my Windows machine but have 1P handle the ssh keys to my repos in GitHub.

I use docker run -it and do not use SSH to connect to the container.

Hi @aetos:

Are you able to configure which command is used to connect to your container? If you use ssh -A to forward your SSH agent, then you should be prompted to use 1Password for SSH. Let me know how you get on with that.

Jack

I am working with Windows and VSCode DevContainer.
Creating a repository on a Docker Volume instead of mounting a local directory improves performance and enables change watching using inotify.
In this case, Git must be run inside the Docker container to clone the code, sign the commit, and push it, which requires SSH.
However, there is no way to communicate between the SSH client in the Docker container and the 1Password SSH Agent on Windows.
Unlike WSL, the npiperelay cannot be run on the Docker container.

When I execute Git commands on the container, I want to be automatically prompted for authentication by Windows Hello to use the SSH key managed by 1Password.