Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for Windows OpenSSH agent forwarding #2124

Closed
sschaap opened this issue May 20, 2021 · 2 comments
Closed

Support for Windows OpenSSH agent forwarding #2124

sschaap opened this issue May 20, 2021 · 2 comments

Comments

@sschaap
Copy link
Contributor

sschaap commented May 20, 2021

Buildkit is unable to forward keys from Windows OpenSSH agent. The Microsoft fork of OpenSSH exposes its agent on a named pipe, which cannot be connected to using the net.Dial*() functions that work for UNIX sockets. Trying to pass the named pipe path \\.\pipe\openssh-ssh-agent as SSH socket yields (using 70deac1 on Windows 10 with OpenSSH_for_Windows_8.1p1):

> buildctl build --ssh default=\\.\pipe\openssh-ssh-agent
error: failed to open \\.\pipe\openssh-ssh-agent: open \\.\pipe\openssh-ssh-agent: All pipe instances are busy.

Note that this issue is separate from #914 where the SSH socket seems to be a cygwin or msys socket, rather than a named pipe.

Support for Windows OpenSSH requires:

  • Detection of named pipe paths on Windows.
  • Use of e.g. winio.DialPipe() to connect to the pipe.
  • (optional) Use of named pipe as default SSH agent path if available and not otherwise specified.

This would likely also resolve the downstream docker/buildx#409 issue regarding use of --ssh default on Windows 10.

I have implemented these changes in sschaap/buildkit@d74e356 for personal use. This makes Windows OpenSSH work seamlessly with buildkit --ssh default as well as docker buildx --ssh default (when rebuilt with modified buildkit).

Notably, this also works well with KeeAgent, which implements a compatible named pipe interface.

Is there interest in a PR for these changes? Any specific requirements other than sign-off?

@tonistiigi
Copy link
Member

As long as it doesn't break the current cases seems like a fine addition.

@tonistiigi
Copy link
Member

#2127

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants