moby / moby/buildkit

Dockerfile - Load key "/root/.ssh/id_rsa": invalid format with Build Kit

Open
#4,307 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
10.3k
Forks
1.5k
Avg merge
1d 23h
Merged PRs (30d)
48

Description

I got the following error:

11 2.895 In Git.php line 453:
#11 2.895                                                                                
#11 2.895   Failed to execute git clone --mirror -- 'git@gitlab.com:test/test/  
#11 2.895   test/data-etstgit' '/root/.composer/cache/vcs/git-gitlab.com
#11 2.895   -test.git/'                                 
#11 2.895                                                                                
#11 2.895   Cloning into bare repository '/root/.composer/cache/vcs/git-gitlab.com
#11 2.895  test.git'...                               
#11 2.895   Warning: Permanently added the RSA host key for IP address '1.1.11.1' to   
#11 2.895   the list of known hosts.                                                     
#11 2.895   Load key "/root/.ssh/id_rsa": invalid format                                 
#11 2.895   git@gitlab.com: Permission denied (publickey).                          
#11 2.896   fatal: Could not read from remote repository.                                
#11 2.896                                                                                
#11 2.896   Please make sure you have the correct access rights                          
#11 2.896   and the repository exists.  

While building this test Dockerfile:

FROM alpine

RUN mkdir /root/.ssh/
RUN --mount=type=secret,id=ssh_key,dst=/etc/secrets/ssh_key cat /etc/secrets/ssh_key > /root/.ssh/id_rsa && chmod 400 /root/.ssh/id_rsa
RUN cat /root/.ssh/id_rsa

RUN touch /root/.ssh/known_hosts && \
      ssh-keyscan -t rsa gitlab.com >> /root/.ssh/known_hosts 

ADD source .
RUN composer install -o -n --no-scripts

RUN mkdir -pv -m 0777 var var/log var/cache var/cache/prod && \
      chmod -R 777 var && chown -R 33:33 var

The command that I execute for it:

echo -n "$BITBUCKET_SSH_KEY" > ssh_key
    DOCKER_BUILDKIT=1 docker build --pull --secret id=ssh_key,src=./ssh_key -f Dockerfile-php -t ${TAG} .

However, I have also tried just to use env varible for docker secret with the following build command:

DOCKER_BUILDKIT=1 docker build --pull --secret id=SSH_KEY,env=BITBUCKET_SSH_KEY -f Dockerfile-php -t${TAG} .

And with this changed Dockerfile layer:

RUN --mount=type=secret,id=SSH_KEY cat /run/secrets/SSH_KEY  > /root/.ssh/id_rsa && chmod 400 /root/.ssh/id_rsa

With debug layer - RUN cat /root/.ssh/id_rsa I see that id_rsa looks totally fine inside container, as it should look like ssh key, however the error of invalid format still persists

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with Dockerfile-php and the supplied test Dockerfile, then reproduce the issue using the --mount=type=secret Docker BuildKit commands and both file- and environment-backed secrets. Trace how the mounted key reaches /root/.ssh/id_rsa and compare it with the SSH failure; done means identifying the cause of the invalid-format error and documenting or validating the relevant fix.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, dockerfile
Domain
build-system, devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.