Hi,
还没有人认领这个 Issue。
评估
调研方向
Start with the devcontainer specification and its existing customization fields; the issue names no files or tests. Work out how an SSH agent allow-list would fit the specification, including filtering identity responses and signing requests, and define what happens when a host has multiple agent sockets. Done means the proposal has a clear, agreed specification and tests for its behavior.
由索引模型根据 Issue 内容生成。
描述
Hi,
I'm nowadays using devcontainers typically to create project-specific sandboxes for Coding-Agents.
My Problem is that devcontainers forwards my SSH-Agent-Socket and therefore allows a container to access all SSH-Keys provided by that agent.
So processes inside a Container can utilize my Keys and therefore have much more access as they need.
What I would like to have would be an allow-list for ssh-keys in the specification.
Something like (proposal):
{
"name": "Project A",
"customizations": {
"sshAgent": {
"allowedKeys": [
"id_ed25519_client_a",
"SHA256:4aF...k9z"
]
}
}
}
(It might also be a good idea to allow specify the SSH-Agent-Socket on the host - in case someone has multiple sockets running...)
This could be archived through a simple SSH-Agent-Filter:
[ Container ] (SSH-Client)
│
▼ /tmp/ssh-agent-devcontainer-<project-id>.sock
[ Host-Proxy ] (SSH-Agent-Filter) ── Allowlist-Filtering
│
▼ $SSH_AUTH_SOCK
[ Host SSH-Agent ] (contains all keys)
So the Host could start a Proxy-Daemon, which creates a dedicated SSH-Agent-Socket.
The socket implements the SSH-Agent-Wire-Protocol, that allows to:
SSH2_AGENTC_REQUEST_IDENTITIES: catch the real ssh-agent and filter the responses to the devcontainerSSH2_AGENTC_SIGN_REQUEST: verify allow-listed key-signatures when using a key
This would allow for much easier handling of container-specific ssh-keys.
I hope you like it and would be really glad if this could be added.
Originally posted by @chdalski in https://github.com/devcontainers/spec/discussions/780
- 主要语言
- 没有语言数据
- 星标
- 5.8k
- 派生
- 509
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
devcontainers/spec 的其他 Issue
-
CLI sorts Feature options fewest-first, against spec可能已有人在做 @nozaq 于 113 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 76/100
devcontainers/spec#755 · 1 条评论 ·
-
难度 2/5 1-3 小时 新手友好度 78/100
devcontainers/spec#754 · 1 条评论 · 2 个 reaction ·
-
难度 2/5 1-3 小时 新手友好度 64/100
devcontainers/spec#735 · 1 条评论 ·
-
难度 1/5 1 小时以内 新手友好度 62/100
devcontainers/spec#579 · 1 条评论 ·
-
Elbanko未关闭
难度 5/5 一周以上 新手友好度 5/100
devcontainers/spec#784 · 2 个 reaction ·
查看 devcontainers/spec 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 84/100
mglaman/phpstan-drupal#1078 ·
维护者通常 1 天内回复
-
[Bug]: Python mod.Box[T] annotation gets a false generic_arg edge that replaces the parameter_type one ('is' on tree-sitter nodes)可能已有人在做 @rohit-jsfreaky 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 88/100
Graphify-Labs/graphify#5110 · 1 条评论 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 85/100
维护者通常 1 天内回复
-
documentation good first issue
难度 2/5 1-3 小时 新手友好度 76/100
voyageurworks/launch-guard-pack#29 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
bigbio/sdrf-pipelines#372 · 1 条评论 ·
维护者通常 1 天内回复