Hi,

Aberta
  • Algo errado?
#786 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
28/100
Tipo de issue
Funcionalidade
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
json
Domínio
devtools, security

Direção de pesquisa

Start with the devcontainer specification and its existing customization fields; the issue names no files or tests. Work out how an SSH agent allow-list would fit the specification, including filtering identity responses and signing requests, and define what happens when a host has multiple agent sockets. Done means the proposal has a clear, agreed specification and tests for its behavior.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Hi,

I'm nowadays using devcontainers typically to create project-specific sandboxes for Coding-Agents.
My Problem is that devcontainers forwards my SSH-Agent-Socket and therefore allows a container to access all SSH-Keys provided by that agent.
So processes inside a Container can utilize my Keys and therefore have much more access as they need.

What I would like to have would be an allow-list for ssh-keys in the specification.

Something like (proposal):

{
  "name": "Project A",
  "customizations": {
    "sshAgent": {
      "allowedKeys": [
        "id_ed25519_client_a",
        "SHA256:4aF...k9z"
      ]
    }
  }
}

(It might also be a good idea to allow specify the SSH-Agent-Socket on the host - in case someone has multiple sockets running...)

This could be archived through a simple SSH-Agent-Filter:

[ Container ] (SSH-Client)
      │
      ▼  /tmp/ssh-agent-devcontainer-<project-id>.sock
[ Host-Proxy ] (SSH-Agent-Filter) ── Allowlist-Filtering
      │
      ▼  $SSH_AUTH_SOCK
[ Host SSH-Agent ] (contains all keys)

So the Host could start a Proxy-Daemon, which creates a dedicated SSH-Agent-Socket.
The socket implements the SSH-Agent-Wire-Protocol, that allows to:

  • SSH2_AGENTC_REQUEST_IDENTITIES: catch the real ssh-agent and filter the responses to the devcontainer
  • SSH2_AGENTC_SIGN_REQUEST: verify allow-listed key-signatures when using a key

This would allow for much easier handling of container-specific ssh-keys.

I hope you like it and would be really glad if this could be added.

Originally posted by @chdalski in https://github.com/devcontainers/spec/discussions/780

Linguagem predominante
Sem dados de linguagem
Estrelas
5.8k
Forks
509
Nenhum PR com merge em 30d

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de devcontainers/spec

Todas as issues de devcontainers/spec

Issues semelhantes

Mais issues de DevTools

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.