Defence Against the Docker Arts

Re:Defence Against the Docker Arts by meowface on Wednesday April 03, 2019 @06:32PM (#19567787)

My favorite Docker BuildKit feature is SSH agent forwarding. Add "--mount=type=ssh" after RUN commands in Dockerfiles and the command will use your host machine's SSH agent. I've been able to greatly simplify a lot of Dockerfiles and CI build processes using it.

There's a good introduction here: https://medium.com/@tonistiigi/build-secrets-and-ssh-forward...

[ Parent | on HN ]

Re:Defence Against the Docker Arts by bsilvereagle on Thursday April 04, 2019 @12:49AM (#19569414)

This feature currently does not work with the OS X ssh agent:

https://github.com/docker/for-mac/issues/410

[ Parent | on HN ]

Re:Defence Against the Docker Arts by auvrw on Thursday April 04, 2019 @08:27AM (#19571333)

ssh access at build time via buildkit works on os x

https://medium.com/@tonistiigi/build-secrets-and-ssh-forward...

the link you've supplied regards ssh access when running docker images, not when building them.

... i did notice that for lots of downloads, it is somewhat slower, or perhaps more prone to lag, than authentication from inside the running image.

[ Parent | on HN ]

Re:Defence Against the Docker Arts by theptip on Wednesday April 03, 2019 @06:55PM (#19567904)

Oh, that's nice -- that's been a pain point for a long time, and it seemed like there was a philosophical argument against making the Dockerfile's behaviour context-dependent like this.

[ Parent | on HN ]

Re:Defence Against the Docker Arts by meowface on Wednesday April 03, 2019 @07:22PM (#19568074)

You do have to pass an extra "--ssh default" argument to "docker build", so it's not totally automagical or anything.

[ Parent | on HN ]