英文:
Why could git not clone private repo during docker build with '--mount=type=ssh'
问题
我正在尝试构建一个包含私有存储库的Docker容器。对于我需要的其他存储库,我没有问题克隆它们,但因为其中一个是私有的,我的同事建议我使用--mount=type=ssh
。我已经浏览了一些文章,查看了同事提供的一个有效示例(该示例对其他人有效,但对我无效),并双重检查了以下问题中的信息:
unable to close private repo during docker build [closed]
Git clone private repo inside a docker container
git clone private repo with --mount=type=ssh does not work
但我无法让它工作。我已经验证了SSH代理正在运行:
$ eval $(ssh-agent)
代理进程 ID 169089
$ echo $SSH_AUTH_SOCK
/tmp/ssh-.../agent.169088
ssh-add /home/<用户名>/.ssh/id_ed25519
而且我相信它已正确配置,因为我可以在我的主机机器上克隆存储库而没有任何问题。然而,当我尝试在构建期间将其克隆到容器中时(在具有此Docker文件的文件夹中的终端中使用docker build . -t test:latest
):
FROM ubuntu:20.04
SHELL ["/bin/bash", "-c"]
ARG proj_name=test
ARG test_user=test
ARG test_uid=1000
ARG test_gid=1000
# 修复apt-get更新/安装期间的哈希和数据不一致错误
RUN echo $'Acquire::http::Pipeline-Depth 0;\n\
Acquire::http::No-Cache true;\n\
Acquire::BrokenProxy true;\n'\
>> /etc/apt/apt.conf.d/90fix-hashsum-mismatch
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && \
echo $TZ > /etc/timezone && \
apt-get update -o Acquire::CompressionTypes::Order::=gz && \
apt-get install --no-install-recommends --yes \
openssh-client git ca-certificates && update-ca-certificates
RUN groupadd --gid $test_gid $test_user && \
useradd --create-home --gid $test_gid --uid $test_uid --shell /bin/bash --groups sudo $test_user && \
echo "$test_user:test" | chpasswd && \
echo "root:test" | chpasswd && \
echo 'set -o vi' > /home/$test_user/.bashrc && \
mkdir -p /home/$test_user/.ssh && \
chmod 700 /home/$test_user/.ssh && \
ssh-keyscan github.com >> /home/$test_user/.ssh/known_hosts && \
mkdir -p /opt/$proj_name/{source,build} && \
chown -R $test_user:$test_user /opt/$proj_name /opt/$proj_name/{source,build} /home/$test_user/.ssh
USER $test_user
# LibApriltag (public)
RUN cd /opt/$proj_name && \
git clone https://github.com/AprilRobotics/apriltag.git
# 私有存储库
RUN --mount=type=ssh,uid=$test_uid cd /opt/$proj_name && \
git clone git@github.com:<private_repo>.git
我收到以下输出:
> [stage-0 6/6] RUN --mount=type=ssh,uid=1000 cd /opt/test && git clone git@github.com:<private_repo>.git:
#0 0.282 Cloning into '<private_repo>'...
#0 0.368 Warning: Permanently added the ECDSA host key for IP address <IP> to the list of known hosts.
#0 0.457 git@github.com: Permission denied (publickey).
#0 0.458 fatal: Could not read from remote repository.
#0 0.458
#0 0.458 Please make sure you have the correct access rights
#0 0.458 and the repository exists.
我尝试了一些不同的用户/UID/SSH设置组合,这些设置似乎是潜在的问题(尽管与同事的示例最相似),但都无济于事,我还禁用了严格的主机密钥检查。在我所做的之后,任何进一步的尝试都将是一种瞎猜,因为我对Docker或Git权限问题不太熟悉,所以我希望有人可以解释我可能还需要做什么,以允许我克隆这个私有存储库。
英文:
I am trying to build a docker container with a private repo installed. I have no issue cloning the other repos that I require, but because one is private, it was suggested by a colleague to use --mount=type=ssh
. I have skimmed a few articles, looked at a working example this colleague supplied (the example does not work for me but does for everyone else), and double checked the info in these questions:
unable to close private repo during docker build [closed]
Git clone private repo inside a docker container
git clone private repo with --mount=type=ssh does not work
But I have been unable to get it working. I have verified that the ssh agent is running:
$ eval $(ssh-agent)
Agent pid 169089
$ echo $SSH_AUTH_SOCK
/tmp/ssh-.../agent.169088
ssh-add /home/<username>/.ssh/id_ed25519
And I believe it is configured properly because I can clone the repository on my host machine with no issue. When I attempt to clone this into a container during build however (using docker build . -t test:latest
from the terminal in the folder with this dockerfile):
FROM ubuntu:20.04
SHELL ["/bin/bash", "-c"]
ARG proj_name=test
ARG test_user=test
ARG test_uid=1000
ARG test_gid=1000
# fix hashsum mismatch error during apt-get update/install
RUN echo $'Acquire::http::Pipeline-Depth 0;\n\
Acquire::http::No-Cache true;\n\
Acquire::BrokenProxy true;\n'\
>> /etc/apt/apt.conf.d/90fix-hashsum-mismatch
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && \
echo $TZ > /etc/timezone && \
apt-get update -o Acquire::CompressionTypes::Order::=gz && \
apt-get install --no-install-recommends --yes \
openssh-client git ca-certificates && update-ca-certificates
RUN groupadd --gid $test_gid $test_user && \
useradd --create-home --gid $test_gid --uid $test_uid --shell /bin/bash --groups sudo $test_user && \
echo "$test_user:test" | chpasswd && \
echo "root:test" | chpasswd && \
echo 'set -o vi' > /home/$test_user/.bashrc && \
mkdir -p /home/$test_user/.ssh && \
chmod 700 /home/$test_user/.ssh && \
ssh-keyscan github.com >> /home/$test_user/.ssh/known_hosts && \
mkdir -p /opt/$proj_name/{source,build} && \
chown -R $test_user:$test_user /opt/$proj_name /opt/$proj_name/{source,build} /home/$test_user/.ssh
USER $test_user
# LibApriltag (public)
RUN cd /opt/$proj_name && \
git clone https://github.com/AprilRobotics/apriltag.git
# Private repo
RUN --mount=type=ssh,uid=$test_uid cd /opt/$proj_name && \
git clone git@github.com:<private_repo>.git
I get the ouput:
> [stage-0 6/6] RUN --mount=type=ssh,uid=1000 cd /opt/test && git clone git@github.com:<private_repo>.git:
#0 0.282 Cloning into '<private_repo>'...
#0 0.368 Warning: Permanently added the ECDSA host key for IP address <IP> to the list of known hosts.
#0 0.457 git@github.com: Permission denied (publickey).
#0 0.458 fatal: Could not read from remote repository.
#0 0.458
#0 0.458 Please make sure you have the correct access rights
#0 0.458 and the repository exists.
I have tried a few various combinations of user/uid/ssh setup that made sense as potential culprits (although the coworkers example most closely resembled the above) to no avail, as well as disabled strict host key checking.
Past what I have done, anything more I try will be a shot in the dark as I am not very experienced with docker or git permission issues, so I am hoping someone can explain what else I may need be missing that could allow me to clone this private repo.
答案1
得分: 2
这是一个相对简单的修复,我的docker构建命令缺少参数--ssh default
。在运行以下命令时:
docker build --ssh default . -t test:latest
构建成功完成。
英文:
This one was a relatively simple fix, the argument --ssh default
was missing from my docker build command. when running
docker build --ssh default . -t test:latest
the build was able to complete.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论