Feature request: Allow to modify SSH forwarding for docker daemon

[mctigger]

I usually use SSH forwarding from host to container as follows:

-v $SSH_AUTH_SOCK:$SSH_AUTH_SOCK -e SSH_AUTH_SOCK=$SSH_AUTH_SOCK

However, this seems to conflict with the current way of mounting the .ssh directory of the host. Could you maybe add an option in the config file to overwrite this part of the docker run arguments like the one I would like to use?

[vinh-cao]

Hi, I don't really get, what you are trying. But how about to install openssh-server inside the container, change the ssh port in /etc/ssh/sshd_config, turn it on with service ssh start and connect directly to the container? of course, you have to map the ssh port to the host machine. Or you just map the port 22 to other host port like: -p 9000:22. You can add extra docker arguments in clearmlconfig in the home directory.

[bmartinn]

@mctigger I think that in order to make it work you need :

1. Add to the the following extra_docker_arguments

agent.extra_docker_arguments: ["-v", "$SSH_AUTH_SOCK:$SSH_AUTH_SOCK", "-e", "SSH_AUTH_SOCK=$SSH_AUTH_SOCK", ]

Reference: https://github.com/allegroai/clearml-agent/blob/22d5892b12efa2acde304658ad0f08594b3e4ce6/docs/clearml.conf#L131

2. Make sure the agent does not copy/mount the ~/.ssh folder into the docker (which is currently the default behavior)

WDYT ?

[mctigger]

Thank for the answer.

Regarding 2. How do I make sure that ~/.ssh is not mounted/copied?

[mctigger]

Also this:

docker: Error response from daemon: invalid volume specification: '$SSH_AUTH_SOCK:$SSH_AUTH_SOCK': invalid mount config for type "volume": invalid mount path: '$SSH_AUTH_SOCK' mount path must be absolute.

[bmartinn]

Regarding 2. How do I make sure that ~/.ssh is not mounted/copied?

docker run -it <container name> bash then inside the docker ls ~/.ssh

Docker: Error response from daemon: invalid volume specification: '$SSH_AUTH_SOCK:$SSH_AUTH_SOCK':

Try replacing $SSH_AUTH_SOCK in the -v argument, with the actual value (you can get the actual value with echo $SSH_AUTH_SOCK on the host machine)

[mctigger]

What would be the correct way to make clearml not mount the .ssh dir? The forwarding seems to not work when this directory is mounted.

[bmartinn]

@mctigger I think we should add a flag forcing the agent to mount the SSH_AUTH_SOCK. Maybe just below force_git_ssh_protocol we could add use_ssh_auth_sock: false , WDYT?

[mctigger]

Would I still have to replace $SSH_AUTH_SOCK with the actual value then? If no, then I am all for it. If I still had to replace it anyways, then I suggest to have an option to not mount .ssh instead. As you showed I can already use extra_docker_arguments to mount SSH_AUTH_SOCK.

[bmartinn]

@mctigger, I think the idea is for the clearml-agent to do the socket mounting automatically (i.e. resolve the $SSH_AUTH_SOCK) and at the same time disable the auto .ssh mount. How does that sound?

[mctigger]

Sounds good!

[mctigger]

@bmartinn Is there any update on this issue? :)

[bmartinn]

Thanks @mctigger for pinging ! I forgot to update here, the latest RC (1.0.1rc3) already contains an option to disable the SSH mount: export CLEARML_AGENT_DISABLE_SSH_MOUNT=1

The auto SSH_AUTH_SOCK check should be merged after the weekend :)

[jkhenning]

Closing this as this was already released. Please reopen if required.