build: add SSH agent socket forwarder (`docker build --ssh $SSHMOUNTI…

…D=$SSH_AUTH_SOCK`)

Unlike `docker build --secret`, `docker build --ssh` allows the build container to
use SSH keys with passphrases.

  $ eval $(ssh-agent)
  $ ssh-add ~/.ssh/id_rsa
  (Input your passphrase here)
  $ docker build --ssh default=$SSH_AUTH_SOCK ...

This feature requires the daemon with `CapExecMountSSH` build capability (moby/moby#37973) .

Currently, the official Dockerfile frontend does not provide the syntax for using the SSH forwarder.

However, the experimental `RUN --mount=type=ssh` syntax can be enabled by using
the Dockerfile frontend image built with the `BUILDTAGS="dfrunmount dfssh"`, via the `# syntax =` "shebang".

The Dockerfile for the Dockerfile frontend is available at  github.com/moby/buildkit/frontend/dockerfile/cmd/dockerfile-frontend)
The pre-built image is also available as `tonistiigi/dockerfile:ssh20181002` .

An example Dockerfile with `RUN --mount=type=ssh`:

  # syntax = tonistiigi/dockerfile:ssh20181002
  FROM alpine
  RUN apk add --no-cache openssh-client
  RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
  RUN --mount=type=ssh ssh git@gitlab.com | tee /hello
  # "Welcome to GitLab, @GITLAB_USERNAME_ASSOCIATED_WITH_SSHKEY" should be printed here

More info available at moby/buildkit#608, moby/buildkit#655

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
(cherry picked from commit db7399a)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

cli/command/image/build.go

@@ -73,6 +73,7 @@ type buildOptions struct {
  platform string
  untrusted bool
  secrets []string
+ ssh []string
 }
 
 // dockerfileFromStdin returns true when the user specified that the Dockerfile
@@ -158,6 +159,9 @@ func NewBuildCommand(dockerCli command.Cli) *cobra.Command {
 
  flags.StringArrayVar(&options.secrets, "secret", []string{}, "Secret file to expose to the build (only if BuildKit enabled): id=mysecret,src=/local/secret")
  flags.SetAnnotation("secret", "version", []string{"1.39"})
+
+ flags.StringArrayVar(&options.ssh, "ssh", []string{}, "SSH agent socket or keys to expose to the build (only if BuildKit enabled) (format: default|<id>[=<socket>|<key>[,<key>]])")
+ flags.SetAnnotation("ssh", "version", []string{"1.39"})
  return cmd
 }
 

cli/command/image/build_buildkit.go

@@ -27,6 +27,7 @@ import (
  "github.com/moby/buildkit/session/auth/authprovider"
  "github.com/moby/buildkit/session/filesync"
  "github.com/moby/buildkit/session/secrets/secretsprovider"
+ "github.com/moby/buildkit/session/sshforward/sshprovider"
  "github.com/moby/buildkit/util/appcontext"
  "github.com/moby/buildkit/util/progress/progressui"
  "github.com/pkg/errors"
@@ -138,6 +139,13 @@ func runBuildBuildKit(dockerCli command.Cli, options buildOptions) error {
  }
  s.Allow(sp)
  }
+ if len(options.ssh) > 0 {
+ sshp, err := parseSSHSpecs(options.ssh)
+ if err != nil {
+ return errors.Wrapf(err, "could not parse ssh: %v", options.ssh)
+ }
+ s.Allow(sshp)
+ }
 
  eg, ctx := errgroup.WithContext(ctx)
 
@@ -408,3 +416,26 @@ func parseSecret(value string) (*secretsprovider.FileSource, error) {
  }
  return &fs, nil
 }
+
+func parseSSHSpecs(sl []string) (session.Attachable, error) {
+ configs := make([]sshprovider.AgentConfig, 0, len(sl))
+ for _, v := range sl {
+ c, err := parseSSH(v)
+ if err != nil {
+ return nil, err
+ }
+ configs = append(configs, *c)
+ }
+ return sshprovider.NewSSHAgentProvider(configs)
+}
+
+func parseSSH(value string) (*sshprovider.AgentConfig, error) {
+ parts := strings.SplitN(value, "=", 2)
+ cfg := sshprovider.AgentConfig{
+ ID: parts[0],
+ }
+ if len(parts) > 1 {
+ cfg.Paths = strings.Split(parts[1], ",")
+ }
+ return &cfg, nil
+}

docs/reference/commandline/build.md

@@ -59,6 +59,7 @@ Options:
  Unit is optional and can be `b` (bytes), `k` (kilobytes), `m` (megabytes),
  or `g` (gigabytes). If you omit the unit, the system uses bytes.
  --squash Squash newly built layers into a single new layer (**Experimental Only**)
+ --ssh SSH agent socket or keys to expose to the build (only if BuildKit enabled) (format: default|<id>[=<socket>|<key>[,<key>]])
  -t, --tag value Name and optionally a tag in the 'name:tag' format (default [])
  --target string Set the target build stage to build.
  --ulimit value Ulimit options (default [])