Use SSH agent restriction instead of git overrides

[MOZGIII]

Take a look at https://www.openssh.com/agent-restrict.html

This should enable more straightforward support for when multiple deploy keys are in use with docker.

All we have to do it seems is, really, just pass the host as a -h argument when invoking ssh-add.

[MOZGIII]

Never mind, this doesn't allow discriminating by git path - only by the host path, so git overrides are will required. That said, maybe the keys can still be kept at the agent instead of creating files. This, together with git host overrides, might actually eliminate the need to copy actual keys into the container.

[reivilibre]

FWIW: Only the public key identifier is copied into the container, not the private key. So you don't really need to worry about it as it stands.

If you care, you can use a BuildKit secret mount, pack up your .ssh into a tarball (as secret mounts can only be a single file) and extract in the step you use it, then remove within the same step (so it doesn't persist in a container layer).

e.g.

RUN --mount=type=ssh \
    --mount=type=secret,id=gitconfig,target=/root/.gitconfig,required=false \
    --mount=type=secret,id=sshconfig,target=/tmp/ssh.tar,required=false \
    if [ -e /tmp/ssh.tar ]; then tar xf /tmp/ssh.tar -C $HOME && chown $(id -u):$(id -g) -R $HOME/.ssh && chmod go= -R $HOME/.ssh; fi && \
    your_install_command_that_needs_ssh_here && \
    if [ -e /tmp/ssh.tar ]; then rm -r $HOME/.ssh; fi

It's nasty, but does the trick. It is compatible with podman build too