Mount host ssh-agent socket inside Docker container

[scalp42]

Hi folks,

I'm trying to replace Docker Desktop and I'm running into an issue regarding SSH_AUTH_SOCK.

Currently, Docker for Desktop (DD) allows mounting/passing through the host socket from inside the VM (see docker/for-mac#410 (comment))

-v /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock -e SSH_AUTH_SOCK="/run/host-services/ssh-auth.sock"

Any idea how to do that with Rancher?

Thanks in advance!

EDIT: I see that you can tweak the lima YAML: lima-vm/lima#683 (comment)

I tried editing ~/Library/Application Support/rancher-desktop/lima/_config/0.yaml and stop 0/start 0 but no dice. The YAML gets reverted.

EDIT2: tried to make it immutable as a workaround chflags uchange 0.yaml but won't work

[adamkpickering]

What are you trying to accomplish? From what I can tell, you're trying to use a docker container as a location from which you ssh to another host. Is this what you're trying to do?

RD runs a Linux VM, inside which it runs dockerd. So in order to get any files to be usable through the -v flag of docker, you first need them to be available in the VM. This is done through the lima config, which it looks like you've found. By default only a few directories, probably not including SSH_AUTH_SOCK, are passed to the VM. When you talk about editing the lima config and doing start 0 stop 0, were you trying to pass files through to the VM?

[scalp42]

The right way is to use Lima override.yaml under _config and it'll work. Cheers!

[juliettepaul]

What exactly did you put in your override.yaml? I have

ssh: 
   forwardAgent: true

but then when I execute a container with nerdctl it does not have access to my ssh auth sock.

Are you passing something to the nerdctl command line to make this work?

[jandubois]

but then when I execute a container with nerdctl it does not have access to my ssh auth sock.

That happens because nerdctl runs using sudo, so doesn't see the agent socket. Can you file a bug for this? I think all that needs to happen is to pass through the SSH_AUTH_SOCK env variable.

[juliettepaul]

I can file a bug. I think it was something different than permissions. I found mounting the SSH_AUTH_SOCK manually helped:

  local ssh_auth_sock=$(LIMA_HOME="$HOME/Library/Application Support/rancher-desktop/lima" "/Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima/bin/limactl" shell 0 printenv SSH_AUTH_SOCK)

It seems that inside the lima-vm there is a different filename for the forwarded agent in SSH_AUTH_SOCK than on my mac. I needed to mount that file into the container and set the SSH_AUTH_SOCK environment variable. SSH_AUTH_SOCK on my mac is some /private/tmp/com.apple.launchd.eZP2RjkHdW/Listeners which does not exist inside the lima-vm.

[juliettepaul]

Submitted here: #2072