Git在使用’–mount=type=ssh’时无法克隆私有存储库的原因是什么?

huangapple go评论63阅读模式
英文:

Why could git not clone private repo during docker build with '--mount=type=ssh'

问题

我正在尝试构建一个包含私有存储库的Docker容器。对于我需要的其他存储库,我没有问题克隆它们,但因为其中一个是私有的,我的同事建议我使用--mount=type=ssh。我已经浏览了一些文章,查看了同事提供的一个有效示例(该示例对其他人有效,但对我无效),并双重检查了以下问题中的信息:

unable to close private repo during docker build [closed]

Git clone private repo inside a docker container

git clone private repo with --mount=type=ssh does not work

但我无法让它工作。我已经验证了SSH代理正在运行:

$ eval $(ssh-agent)
代理进程 ID 169089
$ echo $SSH_AUTH_SOCK
/tmp/ssh-.../agent.169088
ssh-add /home/<用户名>/.ssh/id_ed25519

而且我相信它已正确配置,因为我可以在我的主机机器上克隆存储库而没有任何问题。然而,当我尝试在构建期间将其克隆到容器中时(在具有此Docker文件的文件夹中的终端中使用docker build . -t test:latest):

FROM ubuntu:20.04
SHELL ["/bin/bash", "-c"]

ARG proj_name=test
ARG test_user=test
ARG test_uid=1000
ARG test_gid=1000

# 修复apt-get更新/安装期间的哈希和数据不一致错误
RUN echo $'Acquire::http::Pipeline-Depth 0;\n\
	    Acquire::http::No-Cache true;\n\
	    Acquire::BrokenProxy    true;\n'\
    >> /etc/apt/apt.conf.d/90fix-hashsum-mismatch

RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && \
    echo $TZ > /etc/timezone && \
    apt-get update -o Acquire::CompressionTypes::Order::=gz && \
    apt-get install --no-install-recommends --yes \
        openssh-client git ca-certificates && update-ca-certificates

RUN groupadd --gid $test_gid $test_user && \
    useradd --create-home --gid $test_gid --uid $test_uid --shell /bin/bash --groups sudo $test_user && \
    echo "$test_user:test" | chpasswd && \
    echo "root:test" | chpasswd && \
    echo 'set -o vi' > /home/$test_user/.bashrc && \
    mkdir -p /home/$test_user/.ssh && \
    chmod 700 /home/$test_user/.ssh && \
    ssh-keyscan github.com >> /home/$test_user/.ssh/known_hosts && \
    mkdir -p /opt/$proj_name/{source,build} && \
    chown -R $test_user:$test_user /opt/$proj_name /opt/$proj_name/{source,build} /home/$test_user/.ssh

USER $test_user

# LibApriltag (public)
RUN cd /opt/$proj_name && \
    git clone https://github.com/AprilRobotics/apriltag.git

# 私有存储库
RUN --mount=type=ssh,uid=$test_uid cd /opt/$proj_name && \
    git clone git@github.com:<private_repo>.git

我收到以下输出:

> [stage-0 6/6] RUN --mount=type=ssh,uid=1000 cd /opt/test &&     git clone git@github.com:<private_repo>.git:                                                                               
#0 0.282 Cloning into '<private_repo>'...
#0 0.368 Warning: Permanently added the ECDSA host key for IP address <IP> to the list of known hosts.
#0 0.457 git@github.com: Permission denied (publickey).
#0 0.458 fatal: Could not read from remote repository.
#0 0.458 
#0 0.458 Please make sure you have the correct access rights
#0 0.458 and the repository exists.

我尝试了一些不同的用户/UID/SSH设置组合,这些设置似乎是潜在的问题(尽管与同事的示例最相似),但都无济于事,我还禁用了严格的主机密钥检查。在我所做的之后,任何进一步的尝试都将是一种瞎猜,因为我对Docker或Git权限问题不太熟悉,所以我希望有人可以解释我可能还需要做什么,以允许我克隆这个私有存储库。

英文:

I am trying to build a docker container with a private repo installed. I have no issue cloning the other repos that I require, but because one is private, it was suggested by a colleague to use --mount=type=ssh. I have skimmed a few articles, looked at a working example this colleague supplied (the example does not work for me but does for everyone else), and double checked the info in these questions:

unable to close private repo during docker build [closed]

Git clone private repo inside a docker container

git clone private repo with --mount=type=ssh does not work

But I have been unable to get it working. I have verified that the ssh agent is running:

$ eval $(ssh-agent)
Agent pid 169089
$ echo $SSH_AUTH_SOCK
/tmp/ssh-.../agent.169088
ssh-add /home/&lt;username&gt;/.ssh/id_ed25519

And I believe it is configured properly because I can clone the repository on my host machine with no issue. When I attempt to clone this into a container during build however (using docker build . -t test:latest from the terminal in the folder with this dockerfile):

FROM ubuntu:20.04
SHELL [&quot;/bin/bash&quot;, &quot;-c&quot;]
ARG proj_name=test
ARG test_user=test
ARG test_uid=1000
ARG test_gid=1000
# fix hashsum mismatch error during apt-get update/install
RUN echo $&#39;Acquire::http::Pipeline-Depth 0;\n\
Acquire::http::No-Cache true;\n\
Acquire::BrokenProxy    true;\n&#39;\
&gt;&gt; /etc/apt/apt.conf.d/90fix-hashsum-mismatch
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime &amp;&amp; \
echo $TZ &gt; /etc/timezone &amp;&amp; \
apt-get update -o Acquire::CompressionTypes::Order::=gz &amp;&amp; \
apt-get install --no-install-recommends --yes \
openssh-client git ca-certificates &amp;&amp; update-ca-certificates
RUN groupadd --gid $test_gid $test_user &amp;&amp; \
useradd --create-home --gid $test_gid --uid $test_uid --shell /bin/bash --groups sudo $test_user &amp;&amp; \
echo &quot;$test_user:test&quot; | chpasswd &amp;&amp; \
echo &quot;root:test&quot; | chpasswd &amp;&amp; \
echo &#39;set -o vi&#39; &gt; /home/$test_user/.bashrc &amp;&amp; \
mkdir -p /home/$test_user/.ssh &amp;&amp; \
chmod 700 /home/$test_user/.ssh &amp;&amp; \
ssh-keyscan github.com &gt;&gt; /home/$test_user/.ssh/known_hosts &amp;&amp; \
mkdir -p /opt/$proj_name/{source,build} &amp;&amp; \
chown -R $test_user:$test_user /opt/$proj_name /opt/$proj_name/{source,build} /home/$test_user/.ssh
USER $test_user
# LibApriltag (public)
RUN cd /opt/$proj_name &amp;&amp; \
git clone https://github.com/AprilRobotics/apriltag.git
# Private repo
RUN --mount=type=ssh,uid=$test_uid cd /opt/$proj_name &amp;&amp; \
git clone git@github.com:&lt;private_repo&gt;.git

I get the ouput:

 &gt; [stage-0 6/6] RUN --mount=type=ssh,uid=1000 cd /opt/test &amp;&amp;     git clone git@github.com:&lt;private_repo&gt;.git:                                                                               
#0 0.282 Cloning into &#39;&lt;private_repo&gt;&#39;...
#0 0.368 Warning: Permanently added the ECDSA host key for IP address &lt;IP&gt; to the list of known hosts.
#0 0.457 git@github.com: Permission denied (publickey).
#0 0.458 fatal: Could not read from remote repository.
#0 0.458 
#0 0.458 Please make sure you have the correct access rights
#0 0.458 and the repository exists.

I have tried a few various combinations of user/uid/ssh setup that made sense as potential culprits (although the coworkers example most closely resembled the above) to no avail, as well as disabled strict host key checking.
Past what I have done, anything more I try will be a shot in the dark as I am not very experienced with docker or git permission issues, so I am hoping someone can explain what else I may need be missing that could allow me to clone this private repo.

答案1

得分: 2

这是一个相对简单的修复,我的docker构建命令缺少参数--ssh default。在运行以下命令时:

docker build --ssh default . -t test:latest

构建成功完成。

英文:

This one was a relatively simple fix, the argument --ssh default was missing from my docker build command. when running

docker build --ssh default . -t test:latest

the build was able to complete.

huangapple
  • 本文由 发表于 2023年2月16日 02:34:39
  • 转载请务必保留本文链接:https://go.coder-hub.com/75464099.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定