SSH Forwarding In DevContainer

[michealroberts]

I'm hoping someone can help me on this, I am looking to setup SSH forwarding in the most simplest way imaginable, I've consulted many places where there is a brief outline and a description, but alas, none seem to work.

This is my devcontainer.json:

{
  "build": {
    "dockerfile": "../Dockerfile",
    "context": "..",
    "target": "development"
  },
  "customizations": {
    "vscode": {
      "extensions": [
        "charliermarsh.ruff",
        "ms-python.mypy-type-checker",
        "ms-python.python",
        "ms-toolsai.jupyter",
        "tamasfe.even-better-toml"
      ]
    },
    "recommendations": [
      "charliermarsh.ruff",
      "ms-python.mypy-type-checker",
      "ms-python.python",
      "ms-toolsai.jupyter",
      "tamasfe.even-better-toml"
    ],
    "settings": {
      "[python]": {
        "editor.defaultFormatter": "charliermarsh.ruff",
        "editor.formatOnSave": true,
        "editor.semanticHighlighting.enabled": true
      },
      "editor.codeActionsOnSave": {
        "source.organizeImports": "explicit"
      },
      "editor.cursorBlinking": "smooth",
      "editor.cursorSmoothCaretAnimation": "on",
      "editor.cursorStyle": "line",
      "editor.formatOnSave": true,
      "editor.rulers": [
        88
      ],
      "explorer.compactFolders": true,
      "explorer.confirmDelete": true,
      "ruff.codeAction.disableRuleComment": {
        "enable": true
      },
      "ruff.enable": true,
      "ruff.fixAll": true,
      "ruff.importStrategy": "fromEnvironment",
      "ruff.lint.enable": true,
      "ruff.organizeImports": true
    },
    "terminal.integrated.defaultProfile.linux": "zsh",
    "terminal.integrated.profiles.linux": {
      "zsh": {
        "path": "zsh"
      }
    }
  },
  "forwardPorts": [],
  "postStartCommand": "/bin/zsh",
  "runArgs": [
    "--network=host",
    "--env-file",
    "${localWorkspaceFolder}/.devcontainer/.env.config",
    "--cap-add=SYS_TIME"
  ]
}

What do we have to do simply to get everything working together nicely on this? I have tried:

• 1. Standard SSH-Agent Forwarding via Dev Containers Feature

  • Config changes

    "features": {
      "ghcr.io/devcontainers/features/ssh-agent:1": { "version": "latest" }
    }

  • Host prep
    • ssh-add --apple-use-keychain ~/.ssh/id_ed25519
    • ~/.ssh/config with

      Host *
        AddKeysToAgent yes
        UseKeychain yes
        IdentityFile ~/.ssh/id_ed25519
      

  • Result: GHCR 403 errors pulling the feature

• 2. Manual Agent-Socket Bind via mounts + containerEnv

  • Config changes

    "mounts": [
      "source=${localEnv:SSH_AUTH_SOCK},target=/ssh-agent,type=bind"
    ],
    "containerEnv": {
      "SSH_AUTH_SOCK": "/ssh-agent"
    }

  • Host prep
    • eval "$(ssh-agent -s)" + ssh-add ~/.ssh/id_ed25519
  • Result: /ssh-agent socket present in container but ssh-add -l shows no identities

• 3. Manual Agent-Socket Bind via runArgs

  • Config changes

    "runArgs": [
      "-v", "${localEnv:SSH_AUTH_SOCK}:/ssh-agent"
    ],
    "containerEnv": {
      "SSH_AUTH_SOCK": "/ssh-agent"
    }

  • Host prep
    • Same as #2
  • Result: Socket exists but still empty agent inside container

• 4. GUI vs. Terminal VS Code Launch Debug

  • Action
    • Launched VS Code from Dock vs. code . in terminal
    • Enabled terminal.integrated.inheritEnv
  • Result: VS Code terminal saw $SSH_AUTH_SOCK, container still empty

• 5. macOS Keychain + Config Tweak

  • Host commands
    • ssh-add --apple-use-keychain ~/.ssh/id_ed25519
    • ~/.ssh/config snippet as in https://github.com/nikepupu/language_grounding_cad120/pull/1#issue-1414123952 #1
  • Result: Host agent shows key, container agent remains empty

• 6. Full ~/.ssh Directory Bind-Mount (No Agent)

  • Config changes

    "mounts": [
      "source=${localEnv:HOME}/.ssh,target=/home/vscode/.ssh,type=bind"
    ],
    "containerEnv": {
      "SSH_AUTH_SOCK": ""
    }

  • Host prep
    • chmod 700 ~/.ssh + chmod 600 ~/.ssh/id_ed25519
  • Result: Key files visible in container but SSH commands still fail or permission issues persist

At this point I'm tearing my hair out with this for something that should be so simple.

[hinate13]

I assume your dockerfile is using a variant of linux. I'm on Windows 11, and I can load up a docker image pretty simple w/ SSH forwarding.

You may want to read up on it here:
https://code.visualstudio.com/remote/advancedcontainers/sharing-git-credentials

One thing I remember pulling my hair out was regarding you may need to upgrade your SSH on windows. Please refer to this article (https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH) on upgrading it... I was really shocked I needed to do this to fix my SSH. Once I did, everything just worked!

In a nutshell, this is my workflow now a days:

1. On the host, add the key you want to forward:
   ssh-add c:\Users<yourprofile>.ssh<your-private-key>

2. Inside any devcontainer / container, you should be able to list the key forwarded that you can then use. I think a lot of the info you're talking about is obsolete (at least I don't do any of that). In bash, check it's forwarded:

ssh-add -l

You should see something like this:

4096 SHA256:uuQ6KgGac+n+SwNjapiFtHQ2IOpwFG2VwfniXXXXXXX (RSA)

If you're using github, you can use this to confirm access:

ssh -T git@github.com

It should say something like this:

Hi hinate13! You've successfully authenticated, but GitHub does not provide shell access.

Hope that helps!