Selective SSH-Key filtering

[Christoph Dalski (chdalski)]

Hi,

I'm nowadays using devcontainers typically to create project-specific sandboxes for Coding-Agents.
My Problem is that devcontainers forwards my SSH-Agent-Socket and therefore allows a container to access all SSH-Keys provided by that agent.
So processes inside a Container can utilize my Keys and therefore have much more access as they need.

What I would like to have would be an allow-list for ssh-keys in the specification.

Something like (proposal):

{
  "name": "Project A",
  "customizations": {
    "sshAgent": {
      "allowedKeys": [
        "id_ed25519_client_a",
        "SHA256:4aF...k9z"
      ]
    }
  }
}

(It might also be a good idea to allow specify the SSH-Agent-Socket on the host - in case someone has multiple sockets running...)

This could be archived through a simple SSH-Agent-Filter:

[ Container ] (SSH-Client)
      │
      ▼  /tmp/ssh-agent-devcontainer-<project-id>.sock
[ Host-Proxy ] (SSH-Agent-Filter) ── Allowlist-Filtering
      │
      ▼  $SSH_AUTH_SOCK
[ Host SSH-Agent ] (contains all keys)

So the Host could start a Proxy-Daemon, which creates a dedicated SSH-Agent-Socket.
The socket implements the SSH-Agent-Wire-Protocol, that allows to:

• SSH2_AGENTC_REQUEST_IDENTITIES: catch the real ssh-agent and filter the responses to the devcontainer
• SSH2_AGENTC_SIGN_REQUEST: verify allow-listed key-signatures when using a key

This would allow for much easier handling of container-specific ssh-keys.

I hope you like it and would be really glad if this could be added.

[Christoph Dalski (chdalski)]

One more little thing...

Today the Dev Containers extension forwards the host agent on its own whenever SSH_AUTH_SOCK is set on the host: inside the container the forwarded socket appears as /tmp/vscode-ssh-auth-.sock and SSH_AUTH_SOCK in the remote environment points at it.
Therefore, the proposed filter must replace the extension's automatic forwarding or it will still exists under /tmp and every
process in the devcontainer can open it directly