dockerfile: add support for RUN --mount=type=ssh

[AkihiroSuda]

• Needs to be compiled with dfrunmount dfssh
• Implemented options:
  • type(required): needs to be ssh
  • target(optional): the socket path in the container
  • id(optional): id

Test script:

#!/bin/bash
set -exu -o pipefail
REF=localhost:5000/dfssh:latest
ssh-add -l
sudo buildctl build --frontend=dockerfile.v0 --local context=. --local dockerfile=frontend/dockerfile/cmd/dockerfile-frontend \
  --frontend-opt "build-arg:BUILDTAGS=dfrunmount dfssh" \
  --exporter=image --exporter-opt name=$REF --exporter-opt push=true
mkdir -p /tmp/foo
cd /tmp/foo
cat << EOF > Dockerfile
# syntax=$REF
FROM alpine
RUN apk add --no-cache openssh-client
RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
RUN --mount=type=ssh ssh [email protected]
# "Welcome to GitLab, @GITLAB_USERNAME_ASSOCIATED_WITH_SSHKEY" should be printed here
EOF
sudo buildctl build --ssh default=$SSH_AUTH_SOCK --progress=plain --frontend=dockerfile.v0 --local context=. --local dockerfile=.

Signed-off-by: Akihiro Suda [email protected]

[tonistiigi]

target=..., uid=..., and other flags are not implemented at the moment

Could we add these as well now so we don't wait until this is reported? Was there something missing in the llb client library that made it hard to implement?

[AkihiroSuda]

target=..., uid=..., and other flags are not implemented at the moment

Could we add these as well now so we don't wait until this is reported? Was there something missing in the llb client library that made it hard to implement?

• Not so hard, but we need to consider whether we want to support converting username string to uid number automatically
• Do we need to put these field values into id? (as in dfsecrets)

[tonistiigi]

Not so hard, but we need to consider whether we want to support converting username string to uid number automatically

Ah, ok, didn't remember that the uid/perm was not yet implemented for secrets either. Can do this later. But lets add target.

Do we need to put these field values into id? (as in dfsecrets)

No, I don't think and id/target magic makes sense here. Just provide a way to change the mountpoint. ID is still needed if want to use a specific source.

[AkihiroSuda]

updated

[tonistiigi]

Pushed tonistiigi/dockerfile:ssh20181002 for testing. Full experimental build shortly.

[tonistiigi]

@AkihiroSuda Do you want to update after #659 before merge?

[AkihiroSuda]

updated