SSH Forwarding In DevContainer

[Michael Roberts (michealroberts)]

I'm hoping someone can help me on this, I am looking to setup SSH forwarding in the most simplest way imaginable, I've consulted many places where there is a brief outline and a description, but alas, none seem to work.

This is my devcontainer.json:

{
  "build": {
    "dockerfile": "../Dockerfile",
    "context": "..",
    "target": "development"
  },
  "customizations": {
    "vscode": {
      "extensions": [
        "charliermarsh.ruff",
        "ms-python.mypy-type-checker",
        "ms-python.python",
        "ms-toolsai.jupyter",
        "tamasfe.even-better-toml"
      ]
    },
    "recommendations": [
      "charliermarsh.ruff",
      "ms-python.mypy-type-checker",
      "ms-python.python",
      "ms-toolsai.jupyter",
      "tamasfe.even-better-toml"
    ],
    "settings": {
      "[python]": {
        "editor.defaultFormatter": "charliermarsh.ruff",
        "editor.formatOnSave": true,
        "editor.semanticHighlighting.enabled": true
      },
      "editor.codeActionsOnSave": {
        "source.organizeImports": "explicit"
      },
      "editor.cursorBlinking": "smooth",
      "editor.cursorSmoothCaretAnimation": "on",
      "editor.cursorStyle": "line",
      "editor.formatOnSave": true,
      "editor.rulers": [
        88
      ],
      "explorer.compactFolders": true,
      "explorer.confirmDelete": true,
      "ruff.codeAction.disableRuleComment": {
        "enable": true
      },
      "ruff.enable": true,
      "ruff.fixAll": true,
      "ruff.importStrategy": "fromEnvironment",
      "ruff.lint.enable": true,
      "ruff.organizeImports": true
    },
    "terminal.integrated.defaultProfile.linux": "zsh",
    "terminal.integrated.profiles.linux": {
      "zsh": {
        "path": "zsh"
      }
    }
  },
  "forwardPorts": [],
  "postStartCommand": "/bin/zsh",
  "runArgs": [
    "--network=host",
    "--env-file",
    "${localWorkspaceFolder}/.devcontainer/.env.config",
    "--cap-add=SYS_TIME"
  ]
}

What do we have to do simply to get everything working together nicely on this? I have tried:

• 1. Standard SSH-Agent Forwarding via Dev Containers Feature

  • Config changes

    "features": {
      "ghcr.io/devcontainers/features/ssh-agent:1": { "version": "latest" }
    }

  • Host prep
    • ssh-add --apple-use-keychain ~/.ssh/id_ed25519
    • ~/.ssh/config with

      Host *
        AddKeysToAgent yes
        UseKeychain yes
        IdentityFile ~/.ssh/id_ed25519
      

  • Result: GHCR 403 errors pulling the feature

• 2. Manual Agent-Socket Bind via mounts + containerEnv

  • Config changes

    "mounts": [
      "source=${localEnv:SSH_AUTH_SOCK},target=/ssh-agent,type=bind"
    ],
    "containerEnv": {
      "SSH_AUTH_SOCK": "/ssh-agent"
    }

  • Host prep
    • eval "$(ssh-agent -s)" + ssh-add ~/.ssh/id_ed25519
  • Result: /ssh-agent socket present in container but ssh-add -l shows no identities

• 3. Manual Agent-Socket Bind via runArgs

  • Config changes

    "runArgs": [
      "-v", "${localEnv:SSH_AUTH_SOCK}:/ssh-agent"
    ],
    "containerEnv": {
      "SSH_AUTH_SOCK": "/ssh-agent"
    }

  • Host prep
    • Same as #2
  • Result: Socket exists but still empty agent inside container

• 4. GUI vs. Terminal VS Code Launch Debug

  • Action
    • Launched VS Code from Dock vs. code . in terminal
    • Enabled terminal.integrated.inheritEnv
  • Result: VS Code terminal saw $SSH_AUTH_SOCK, container still empty

• 5. macOS Keychain + Config Tweak

  • Host commands
    • ssh-add --apple-use-keychain ~/.ssh/id_ed25519
    • ~/.ssh/config snippet as in https://github.com/nikepupu/language_grounding_cad120/pull/1#issue-1414123952 #1
  • Result: Host agent shows key, container agent remains empty

• 6. Full ~/.ssh Directory Bind-Mount (No Agent)

  • Config changes

    "mounts": [
      "source=${localEnv:HOME}/.ssh,target=/home/vscode/.ssh,type=bind"
    ],
    "containerEnv": {
      "SSH_AUTH_SOCK": ""
    }

  • Host prep
    • chmod 700 ~/.ssh + chmod 600 ~/.ssh/id_ed25519
  • Result: Key files visible in container but SSH commands still fail or permission issues persist

At this point I'm tearing my hair out with this for something that should be so simple.

[hangryBytes]

I assume your dockerfile is using a variant of linux. I'm on Windows 11, and I can load up a docker image pretty simple w/ SSH forwarding.

You may want to read up on it here:
https://code.visualstudio.com/remote/advancedcontainers/sharing-git-credentials

One thing I remember pulling my hair out was regarding you may need to upgrade your SSH on windows. Please refer to this article (https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH) on upgrading it... I was really shocked I needed to do this to fix my SSH. Once I did, everything just worked!

In a nutshell, this is my workflow now a days:

1. On the host, add the key you want to forward:
   ssh-add c:\Users<yourprofile>.ssh<your-private-key>

2. Inside any devcontainer / container, you should be able to list the key forwarded that you can then use. I think a lot of the info you're talking about is obsolete (at least I don't do any of that). In bash, check it's forwarded:

ssh-add -l

You should see something like this:

4096 SHA256:uuQ6KgGac+n+SwNjapiFtHQ2IOpwFG2VwfniXXXXXXX (RSA)

If you're using github, you can use this to confirm access:

ssh -T git@github.com

It should say something like this:

Hi hinate13! You've successfully authenticated, but GitHub does not provide shell access.

Hope that helps!

[Alexandr Kutyrkin (ra5alghu1)]

On macOS with Docker Desktop, I would avoid bind-mounting ${localEnv:SSH_AUTH_SOCK} directly. Docker Desktop exposes the host SSH agent through its own socket:

"mounts": [
"source=/run/host-services/ssh-auth.sock,target=/run/host-services/ssh-auth.sock,type=bind"
],
"containerEnv": {
"SSH_AUTH_SOCK": "/run/host-services/ssh-auth.sock"
}

Before rebuilding the container, verify on the host:

ssh-add -l

Then rebuild the Dev Container and inside it check:

echo "$SSH_AUTH_SOCK"
ls -l "$SSH_AUTH_SOCK"
ssh-add -l
ssh -T git@github.com

If you're opening the project through VS Code Dev Containers, you may not need the manual mount at all: Dev Containers can automatically forward the local SSH agent when one is running.

One thing I would not do is mount the whole ~/.ssh directory into the container unless you specifically need the private key files there. Agent forwarding keeps the private key on the host.

Also, if ssh-add -l works on the Mac but shows no identities inside the container, that usually means the container is connected to the wrong socket rather than the agent itself being empty.

Hope this helps if you're still dealing with this issue.

[Andrés Bretón (bretonics)]

Also, if ssh-add -l works on the Mac but shows no identities inside the container, that usually means the container is connected to the wrong socket rather than the agent itself being empty.

I think this is a indicator, combined with ls -l "$SSH_AUTH_SOCK" inside the container not showing a symlink. Once it reflected a symlink in that socket, the identity was present.

I think what helped on my end was clearing sockets on the host ssh-agent -uu and ensuring before opening the repo in a Dev Container reflected the ssh identity locally, i.e. ssh-add -l.