[27.x backport] disable pseudoterminal creation

cli/connhelper/connhelper.go

@@ -52,6 +52,7 @@ func getConnectionHelper(daemonURL string, sshFlags []string) (*ConnectionHelper
 					args = append(args, "--host", "unix://"+sp.Path)
 				}
 				sshFlags = addSSHTimeout(sshFlags)
+				sshFlags = disablePseudoTerminalAllocation(sshFlags)
 				args = append(args, "system", "dial-stdio")
 				return commandconn.New(ctx, "ssh", append(sshFlags, sp.Args(args...)...)...)
 			},
@@ -79,3 +80,14 @@ func addSSHTimeout(sshFlags []string) []string {
 	}
 	return sshFlags
 }
+
+// disablePseudoTerminalAllocation disables pseudo-terminal allocation to
+// prevent SSH from executing as a login shell
+func disablePseudoTerminalAllocation(sshFlags []string) []string {
+	for _, flag := range sshFlags {
+		if flag == "-T" {
+			return sshFlags
+		}
+	}
+	return append(sshFlags, "-T")
+}

cli/connhelper/connhelper_test.go

@@ -1,6 +1,7 @@
 package connhelper
 
 import (
+	"reflect"
 	"testing"
 
 	"gotest.tools/v3/assert"
@@ -29,3 +30,36 @@ func TestSSHFlags(t *testing.T) {
 		assert.DeepEqual(t, addSSHTimeout(tc.in), tc.out)
 	}
 }
+
+func TestDisablePseudoTerminalAllocation(t *testing.T) {
+	testCases := []struct {
+		name     string
+		sshFlags []string
+		expected []string
+	}{
+		{
+			name:     "No -T flag present",
+			sshFlags: []string{"-v", "-oStrictHostKeyChecking=no"},
+			expected: []string{"-v", "-oStrictHostKeyChecking=no", "-T"},
+		},
+		{
+			name:     "Already contains -T flag",
+			sshFlags: []string{"-v", "-T", "-oStrictHostKeyChecking=no"},
+			expected: []string{"-v", "-T", "-oStrictHostKeyChecking=no"},
+		},
+		{
+			name:     "Empty sshFlags",
+			sshFlags: []string{},
+			expected: []string{"-T"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := disablePseudoTerminalAllocation(tc.sshFlags)
+			if !reflect.DeepEqual(result, tc.expected) {
+				t.Errorf("expected %v, got %v", tc.expected, result)
+			}
+		})
+	}
+}