Feature Request: Adding ssh-keys while baking balena image

[yashkurkure]

Hello!

I have been using chameleon as a part of the FOUNT project at University of Chicago (Argonne). I think it would be great if one could access the chi-edge device via ssh over the local network for development.

According to the balena docs it is possible to do this:
https://github.com/balena-os/meta-balena#sshkeys

I added an option to do this under the bake command in this PR.

Example:

chi-edge device bake --image <image> --ssh-public-key <public ssh key> <device_uuid>

I tested this on my end using a Raspberry Pi 4 registered with chi@edge on my home network.

[msherman64]

Hey, thanks for the PR!

I fully agree that allowing SSH to the device is something that we'd like to add, but there are some caveats before we want to deploy it. Namely, that this needs to be scoped to devices that are only resevable by the device-owner's project, due to the following:

1. this will only work if the devices are flashed with a "development mode" image, but that also removes many of the network security features, so it shouldn't be enabled on a "production device"
2. In addition, a device owner probably shouldn't have access to the containers that some other user is running on the device, which they'd get with this device level SSH.

For your use-case, is ssh to the device needed, or just ssh into a running container?

[yashkurkure]

I agree with that!

For 1 - Would this be done by adding some parameters to the config.json file?
For 2 - Maybe we could allow customizing the ssh-user privileges while baking the image?

I am not entirely sure how to achieve that but if you could point me in the right direction, I could try contributing.

For my use case, I do want to ssh into the device as root to control the containers.

This is mainly because, I have had containers stuck in deleting/creating states and any new containers also get stuck in one of those states.

For now it looks like my only option is to contact the help desk and ask them to be deleted. I would like to at least have more control on the containers being spawned and investigate on why they are stuck.

This would also be helpful for my main goal, which is to containerize waggle-os and be able to run that in a container over chameleon.