Hi,

Offen
  • Stimmt etwas nicht?
#786 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
28/100
Issue-Typ
Feature
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
json
Bereich
devtools, security

Rechercherichtung

Start with the devcontainer specification and its existing customization fields; the issue names no files or tests. Work out how an SSH agent allow-list would fit the specification, including filtering identity responses and signing requests, and define what happens when a host has multiple agent sockets. Done means the proposal has a clear, agreed specification and tests for its behavior.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Hi,

I'm nowadays using devcontainers typically to create project-specific sandboxes for Coding-Agents.
My Problem is that devcontainers forwards my SSH-Agent-Socket and therefore allows a container to access all SSH-Keys provided by that agent.
So processes inside a Container can utilize my Keys and therefore have much more access as they need.

What I would like to have would be an allow-list for ssh-keys in the specification.

Something like (proposal):

{
  "name": "Project A",
  "customizations": {
    "sshAgent": {
      "allowedKeys": [
        "id_ed25519_client_a",
        "SHA256:4aF...k9z"
      ]
    }
  }
}

(It might also be a good idea to allow specify the SSH-Agent-Socket on the host - in case someone has multiple sockets running...)

This could be archived through a simple SSH-Agent-Filter:

[ Container ] (SSH-Client)
      │
      ▼  /tmp/ssh-agent-devcontainer-<project-id>.sock
[ Host-Proxy ] (SSH-Agent-Filter) ── Allowlist-Filtering
      │
      ▼  $SSH_AUTH_SOCK
[ Host SSH-Agent ] (contains all keys)

So the Host could start a Proxy-Daemon, which creates a dedicated SSH-Agent-Socket.
The socket implements the SSH-Agent-Wire-Protocol, that allows to:

  • SSH2_AGENTC_REQUEST_IDENTITIES: catch the real ssh-agent and filter the responses to the devcontainer
  • SSH2_AGENTC_SIGN_REQUEST: verify allow-listed key-signatures when using a key

This would allow for much easier handling of container-specific ssh-keys.

I hope you like it and would be really glad if this could be added.

Originally posted by @chdalski in https://github.com/devcontainers/spec/discussions/780

Vorherrschende Sprache
Keine Sprachdaten
Sterne
5.8k
Forks
509
Keine gemergten PRs in 30 T.

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus devcontainers/spec

Alle Issues in devcontainers/spec

Ähnliche Issues

Weitere Issues zu DevTools

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.