Run script on SSH remote host when connecting

[soletan]

We are running a server which is hosting several containers with lxc. Those containers are available via SFTP directly, thus limiting support for SSH. This is mostly to limit customers' capabilities in either container.

I'd like to use VSCode's Remote SSH editing feature, though, just like I would log into the physical host, then using command lxc-attach -n somecontainer. Thus, I'd like to have the opportunity to run a custom script preparing the connection used by Remote SSH editing feature so that it's actually offering editing in context of attached lxc container instead of the physical host.

Since my setup is rather particular I assume having a more generic support would be preferrable.

[roblourens]

@chrmarti does this have anything to do with #636 or is that Docker-specific?

[chrmarti]

That's Docker-specific. The request here seems to be more generic: Let the user supply a connection method.

[soletan]

@chrmarti does this have anything to do with #636 or is that Docker-specific?

IMHO it doesn't. In my case it's lxc instead of docker and it's just an example for wrapping the whole SSH transport of remote in another tool which is started and running on remote server by means of extending the pipe all control data is passing. I'm also considering a different use case when I have to connect to some SSH server prior to re-connecting to a different SSH server which is behind a firewall and using remote to work on the latter of the two. In this case there is neither lxc nor docker nor any other kind of virtualization.

There could be some generic approach to this and I can't see that in #636.

[roblourens]

Ok. This fits into one or two other requests and I'm trying to figure out how to handle them. So do you want the end result to be SSHing into an SSH server on the container, or SSHing into the host but opening a workspace in the container?

For the second case, are you describing basically a proxy/jump box?

[soletan]

It resembles the latter case, indeed. But as far as I understand ProxyCommand, it is different from those jumpbox-scenarios as well.

Let's forget about the second scenario I was introducing in comment before. This is actually a jump-box setup and I must admit I haven't known ProxyCommand until now. But I don't think this first scenario is feasible using ProxyCommand.

In that first scenario there is an SSH connection between my local client and some physical server. Period. SSH won't reach any further than that. This connection is usually established to interact with a running shell on the server and so it is calling some generic command like lxc-attach -n <container> over there. This command will run another process I can interact with through the existing connection via SSH. In fact, lxc-attach is running yet another shell inside the selected container so I can use that one to control the container. So, from a distant point of view I'm just interacting with a shell in the container just like I've done with a shell on the physical server right before. But instead of preferring an lxc-specific solution I'd rather like to have the opportunity to invoke any single command after logging into the remote server via SSH before Remote SSH is detecting, initializing and establishing the remote environment.

[roblourens]

Ok, so lxc-attach -n gives you a shell in the container? Is there a form of that command that would let us run a script? If so, this is like #1722.

The problem then is still with accessing the server inside the container. We start it listening on some port, then forward that port over the ssh connection. But if the server is outside the container, you would also have to figure out the port and get the container to forward that port outside of the container. Is that possible in this case? Would you need to pick a static port?

[soletan]

Hm, when searching for existing issues I didn't stumbled over #1722. Indeed, this looks pretty much like what I was thinking of.

A command can be appended. See https://linux.die.net/man/1/lxc-attach for that.

Regarding the server I don't think there is any support for that integrated with lxc-attach. For LXC containers don't even have to expose any port for network-based access I assume there is no generic approach either. Back to the question before: how would this work with a docker container on a remote server connected via SSH? Is it possible to enter those? And how is the issue regarding this inner service solved over there?

[roblourens]

Ok, I will merge this issue into that one. For Docker it appears that some docker tool itself is able to take an ssh connection string and connect to a remote docker service.