new feature: `docker -H ssh://host` by AkihiroSuda · Pull Request #33566 · moby/moby

AkihiroSuda · 2017-06-07T11:19:50Z

- What I did

Implemented docker -H ssh://host, which allows connecting to a Unix socket listening on a remote daemon via an OpenSSH connection.

[docker] ----- TCP -----> [sshd] -- Unix --> [dockerd]

Replaces #32161 (which used Go-native SSH rather than os/exec even on Unix, and hence didn't support ~/.ssh/config)

Closes #31871

Motivations:

No mess of setting up TLS properly (ssh-keygen vs a bunch of openssl blah -blah -blah -blah ..., Improve usability for TLS usage and setup #6817)
Single user account management for both regular SSH session and Docker session
Single login monitoring for both

The feature is purely implemented on the client side.
No need to configure the daemon.

- How I did it

on Unix: By os/exec-uting ssh -L local.sock:/var/run/docker.sock. So it should even work with ~/.ssh/config.
on Windows: using pageant + Go-native ssh (golang.org/x/crypto/ssh)

- How to verify it

No need to configure the daemon. Even no need to replace the daemon built from this PR. I confirmed this PR works well with vanilla 17.05.0-ce daemon.
You just need to create a SSH user account that can access /var/run/docker.sock
On Windows client, you need to register your key to pageant.exe. No need to install ssh.exe.

$ go build ./contrib/client-test
$ ./client-test ssh://me@host
(JSON representation of `docker info` will be shown)

The argument can be also:

ssh://me@host:22/var/run/docker.sock
ssh://host (using $USER as the user name)
...

- Description for the changelog
Now docker client can connect to a Unix socket listening on a remote daemon via an OpenSSH connection

- A picture of a cute animal (not mandatory but encouraged)

TODO

Vendor add unix-over-ssh transport docker/go-connections#39

Signed-off-by: Akihiro Suda [email protected]

This commit allows connecting to a Unix socket listening on a remote daemon via an OpenSSH connection. e.g. `docker -H ssh://host` or `docker -H ssh://me@host:22/var/run/docker.sock`. The feature is purely implemented on the client side. No need to configure the daemon. Signed-off-by: Akihiro Suda <[email protected]>

AkihiroSuda · 2017-06-07T11:22:42Z

cc-ing those who has commented on #32161

@vdemeester @n4ss @diogomonica @thaJeztah @justincormack @friism @nathanleclaire @tonistiigi @jhowardmsft @arianitu @rca @stevvooe @chungers

tonistiigi · 2017-06-07T18:27:38Z

 	case "fd":
 		return addr, nil
+	case "ssh": // unix over ssh (can be specified for `docker -H` but not for `dockerd -H`)
+		usr, err := whoami()


Why not let ssh(1) handle this? This calls into /etc/passwd parsing on macOS that doesn't work for regular users. It also overrides any user set in the ssh config.

ok, I'll update

justincormack · 2017-06-12T15:47:44Z

Given that Windows will soon have native openssh support, it seems weird to special case it now?

AkihiroSuda · 2017-06-12T15:55:37Z

@justincormack
If we are going to use socat or nc instead of -L local.sock:/var/run/docker.sock, we can eliminate special case for Windows ( docker/go-connections#39 (comment) )

AkihiroSuda · 2017-07-04T02:27:18Z

Method	No socket file leak	Support `~/.ssh/config`	No dependency on Docker product	Likely to work on default Docker installation
`golang.org/x/crypto/ssh`	✅	❌	✅	✅
`golang.org/x/crypto/ssh`+implement `~/.ssh/config` parser	✅	✅ (hard)	✅	✅
`os/exec("ssh -L local.sock:/var/run/docker.sock)`	❌	✅	✅	✅
`os/exec("ssh socat-or-nc")`	✅	✅	✅	❌ (`socat` and `nc` are rarelly installed)
`os/exec("ssh docker sockproxy")`	✅	✅	❌	✅
`os/exec("ssh dockerd sockproxy")`	✅	✅	❌ (`dockerd` binary name might change on Moby Project)	✅
`os/exec("ssh docker sockproxy \|\| ssh socat-or-nc")`	✅	✅	✅	✅
SSH subsystem + `os/exec("ssh -s somesubsystem")`	✅	✅	✅	❌ (needs to modify `sshd_config`)

design discussion held at docker/go-connections#39

Comments are welcome at docker/go-connections#39

cpuguy83 · 2018-01-10T15:21:40Z

What do you think about implementing a "connection helpers" interface like we do for credentials.
This would allow a user to supply their own custom helpers that will just work natively with the docker CLI.
Helpers can be defined in ~/.docker/config.json matching the protocol of the connection string to a config.
e.g.

{
  "ssh": "~/.docker/ssh_connection_helper",
  "weird": "~/my_weird_connection_helper"
}

Where -H ssh://1.2.3.4:22 would execute the ~/.docker/ssh_connection_helper helper and -H weird://1.2.3.4 would execute ~/my_weird_connection_helper

AkihiroSuda · 2018-01-11T03:11:26Z

@cpuguy83 SGTM, I'll try to update this PR.
Do you come up with other possible plugins?

AkihiroSuda · 2018-02-02T08:36:43Z

Temporarily closing.

Further discussion should be at #31871

AkihiroSuda · 2018-02-20T11:00:53Z

Implemented @cpuguy83 's proposal: docker/cli#889

GordonTheTurtle added the status/0-triage label Jun 7, 2017

AkihiroSuda mentioned this pull request Jun 7, 2017

new feature: docker -H ssh://host #32161

Closed

5 tasks

AkihiroSuda mentioned this pull request Jun 7, 2017

add unix-over-ssh transport docker/go-connections#39

Closed

AkihiroSuda added area/security impact/cli status/1-design-review status/needs-vendoring and removed status/0-triage labels Jun 7, 2017

AkihiroSuda mentioned this pull request Jun 7, 2017

[Proposal] docker -H ssh://me@host/var/run/docker.sock #31871

Closed

tonistiigi reviewed Jun 7, 2017

View reviewed changes

GordonTheTurtle assigned justincormack Jun 22, 2017

AkihiroSuda closed this Feb 2, 2018

AkihiroSuda mentioned this pull request Feb 20, 2018

support connection helpers (e.g. docker -H ssh://me@server) docker/cli#889

Closed

AkihiroSuda mentioned this pull request Oct 5, 2021

Compatability with docker client containers/podman#11668

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new feature: `docker -H ssh://host`#33566

new feature: `docker -H ssh://host`#33566
AkihiroSuda wants to merge 1 commit intomoby:masterfrom
AkihiroSuda:ssh2

AkihiroSuda commented Jun 7, 2017 •

edited

Loading

Uh oh!

AkihiroSuda commented Jun 7, 2017

Uh oh!

tonistiigi Jun 7, 2017 •

edited

Loading

Uh oh!

AkihiroSuda Jun 8, 2017

Uh oh!

justincormack commented Jun 12, 2017

Uh oh!

AkihiroSuda commented Jun 12, 2017

Uh oh!

AkihiroSuda commented Jul 4, 2017

Uh oh!

cpuguy83 commented Jan 10, 2018

Uh oh!

AkihiroSuda commented Jan 11, 2018

Uh oh!

AkihiroSuda commented Feb 2, 2018

Uh oh!

AkihiroSuda commented Feb 20, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

AkihiroSuda commented Jun 7, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AkihiroSuda commented Jun 7, 2017

Uh oh!

tonistiigi Jun 7, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda Jun 8, 2017

Choose a reason for hiding this comment

Uh oh!

justincormack commented Jun 12, 2017

Uh oh!

AkihiroSuda commented Jun 12, 2017

Uh oh!

AkihiroSuda commented Jul 4, 2017

Uh oh!

cpuguy83 commented Jan 10, 2018

Uh oh!

AkihiroSuda commented Jan 11, 2018

Uh oh!

AkihiroSuda commented Feb 2, 2018

Uh oh!

AkihiroSuda commented Feb 20, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

AkihiroSuda commented Jun 7, 2017 •

edited

Loading

tonistiigi Jun 7, 2017 •

edited

Loading