Gitlab SSH key: permission denied from within dev container

[rpeschi]

Description

When inside a dev-container, it is not possible to push/pull/communicate with Gitlab until the command "ssh-add ~/.ssh/<your_key>" (e.g. ssh-add ~/.ssh/id_rsa) is performed: we get "Permission denied" without the possibility to enter a passphrase. For example:

⬢ [Docker] ❯ ssh -T git@gitlab.com
git@gitlab.com: Permission denied (publickey,keyboard-interactive).

Outside the dev container, even without doing the command "ssh-add ~/.ssh/<your_key>", it is possible to interact with Gitlab but the passphrase is required every time. For example:

(base) raphaelpeschi@Raphaels-MBP or-tools-test % ssh -T git@gitlab.com
Enter passphrase for key '/Users/raphaelpeschi/.ssh/id_rsa':
Welcome to GitLab, @Raphael85!

Reproduction

• Given a SSH key for Gitlab that requires a passphrase
• Reboot your laptop
• Using VSCode, open a project using poetry-cookiecutter (it will automatically be inside the dev container)
• Perform the command "ssh -T git@gitlab.com": the following results is obtained:

root in app on  main [!] is 📦 v0.0.0 via 🐍 v3.8.12
⬢ [Docker] ❯ ssh -T git@gitlab.com
git@gitlab.com: Permission denied (publickey,keyboard-interactive).

Workarounds

Method 1) Push/pull from outside the container (e.g. open a new terminal outside VSCode)

Method 2) After each laptop reboot, perform the command "ssh-add ~/.ssh/<your_key>" outside the dev container. This will allow to interact with Gitlab without entering the passphrase, both outside and within dev containers.

[rpeschi]

ANALYSIS

1. Regardless of the poetry-cookiecutter, when a passphrase is associated to a SSH key, it is the expected behaviour that the passphrase is required after each reboot of the machine. It is however possible to make the passphrase persist using the Keychain integration: passphrase persist by using the Keychain integration

2. In the poetry-cookiecutter framework, it is expected that until keys are added to the "mounted" SSH agent, the dev container environment doesn't know about any SSH keys. Indeed, in the docker-compose.yml file, currently only the SSH agent socket (SSH_AGENT_AUTH_SOCK) + known hosts file is mounted, not the full ~/.ssh directory.

RESOLUTION

There is no issue as such. To be able to communicate with Gitlab from within the dev container without having to do " ssh-add ~/.ssh/id_rsa" after each reboot, follow these steps:

• Add these lines to ~/.ssh/config:
  Host *
  UseKeychain yes
• Reboot your laptop
• Open you project in VSCode, type "Remote container - Rebuild without cache"

[tanguyNaets]

Perhaps it's worth reopening that issue until the "resolution" gets incorporated in the Readme's optional set-up steps for users of SSH Keys with passphrases?

[lsorber]

@tanguyNaets It's technically already in the README as one of the one-time setup steps (cf. line 21 for GitLab and line 39 for GitHub). But perhaps we should make it more clear in the README that this step is very much necessary for a good experience.

[lsorber]

Update: I created a PR to make the SSH configuration more explicit in the README.