Forwarding WSL2 ssh-agent into DevContainer is not working. #3902
Comments
|
Could you attach the Dev Container log ( |
|
With setting SSH_AUTH_SOCK in without setting SSH_AUTH_SOCK in |
|
What do you get when you run the following in PowerShell: |
|
@chrmarti It can be an issue with iptables configuration behind Docker port mapping. In the recent Docker Desktop version running on the Linux 4.9 WSL Kernel. I was surprised to see that WSL Docker daemon really manages iptables.I'm not a Linux security specialist and from 1st look iptables -L on Docker-desktop distro shows that everything allowed in both directions but iptables interpretation is the real hell. The documentation provided by Docker in the Docker Networking part talks about how to config iptables for access to container ports outside. In the distro-to-distro scenario where client and server can communicate either via WSL VM localhost or docker.host.internal, I suppose the second option is more reliable. |
Gives me |
|
@mattcrn Do you have |
|
|
The intra-container network is 100% isolated from the host unless it is Docker on Linux and network=host. |
|
@mattcrn Make sure you have 'Inherit Env' enabled in the settings (it is enabled by default): |
|
@PavelSosin-320 We are using socket paths here and set up our own backward channel. |
|
I afraid socat will not help you because DockerDektop-for Win by default listens npipe - see docker context ls only for ephemeral performance gain. |
It is enabled. |
|
Do you have some other shell set as the default than bash? We run |
|
|
|
Is anybody able to reproduce this problem? |
|
I've did the following steps to make WSL2 ssh-agent forwarding to devcontainer work in my WSL distro (Ubuntu 20.04):
# ~/.profile: executed by the command interpreter for login shells.
# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.
# the default umask is set in /etc/profile; for setting the umask
# for ssh logins, install and configure the libpam-umask package.
#umask 022
# if running bash
if [ -n "$BASH_VERSION" ]; then
# include .bashrc if it exists
if [ -f "$HOME/.bashrc" ]; then
. "$HOME/.bashrc"
fi
fi
# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ] ; then
PATH="$HOME/bin:$PATH"
fi
# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/.local/bin" ] ; then
PATH="$HOME/.local/bin:$PATH"
fi
eval $(keychain --eval --agents ssh id_rsa)
# If not running interactively, don't do anything
#case $- in
# *i*) ;;
# *) return;;
#esac
After that, my ssh-agent forwarding from WSL2 distro to devcontainer works properly. |
|
@lbssousa, your solution didn't exactly work for me but just installing eval $(keychain --eval --agents ssh id_rsa)at the top of my .bashrc did the trick for me. |
|
Just in case this is useful for someone else: The answer to https://stackoverflow.com/questions/18880024/start-ssh-agent-on-login also appears to work well. Thanks. |
chrmarti
added
*question
|
Since this is an integral ingredient of the devcontainer workflow promoted by vs-code It would make sense to provide a solution in the docs for this. |
|
Having @Chuxel Should we mention it here: https://code.visualstudio.com/docs/containers/ssh ? |
chrmarti
added
doc
and removed
*question
|
Reopening for the doc suggestion. |
|
I've been able to replicate this when I was using zsh as my shell. The environment variable SSH_AUTH_SOCK was not being passed through even with the |
|
@ross-p-smith Try placing your |
What is it about this that makes it work, that all the other methods I've tried today don't work? It's great that this method works, but why this over the numerous other snippets people suggest to add to your init scripts? |
|
Just out of curiosity. I do a slightly different approach. I have a devcontainers recipe which provides a volume for the project. This way I keep my ssh, git and pgp things in windows, and all are forwarded to the devcontainer nicely (ssh-agent service enabled). But when running from WSL2 filesystem, VSCode is using ssh, git and pgp from the distro the devcontainers folder is hosted in. I find it a bit annoying, not to have an option to tell VSCode to always use my gitconfig, ssh config, know_hosts and agent, and pgp from Windows, like it does for devcontainers folder hosted on windows fs. For everybody having all setup in Windows, I think it would do a huge help to have that switch, as the official docs already provide perfect guidance how to prepare your windows host for devcontainers. It simply breaks the minute u have the folder in wsl2... Can you postpone and work on using also ssh, git and pgp from wsl2 after u allow people that completed all settings according to the current official docs to benefit of this automation from both windows fs and wsl fs? |
|
The key difficulty here was that the ssh-agent had to be started also for a non-interactive login shells (using, e.g., Closing as the main concern has been fixed as part of #2994 in code. Thanks. Opened #5610 to track @madalinignisca 's suggestion. |
Steps to Reproduce:
ssh-agent -lget this error:
Could not open a connection to your authentication agent.echo $SSH_AUTH_SOCKget empty line
Now for something else I tried:
export SSH_AUTH_SOCK=testNow
$SSH_AUTH_SOCKhas something like/tmp/vscode-ssh-auth-22aa630c3293905f2a753276fd8cf09320ce8d58.sockbut
ssh-agent -lgiveserror fetching identities: communication with agent failedIf I expoort socket and SSH_AUTH_SOCK via docker-compose file, everything works but I cannot get it to work with vscode.
The text was updated successfully, but these errors were encountered: