{"action":"created","issue":{"url":"https://api.github.com/repos/magfest/ubersystem-docker/issues/7","labels_url":"https://api.github.com/repos/magfest/ubersystem-docker/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/magfest/ubersystem-docker/issues/7/comments","events_url":"https://api.github.com/repos/magfest/ubersystem-docker/issues/7/events","html_url":"https://github.com/magfest/ubersystem-docker/issues/7","id":84005533,"number":7,"title":"optional: support SSH keys in Docker builds","user":{"login":"binary1230","id":5413064,"avatar_url":"https://avatars.githubusercontent.com/u/5413064?v=3","gravatar_id":"","url":"https://api.github.com/users/binary1230","html_url":"https://github.com/binary1230","followers_url":"https://api.github.com/users/binary1230/followers","following_url":"https://api.github.com/users/binary1230/following{/other_user}","gists_url":"https://api.github.com/users/binary1230/gists{/gist_id}","starred_url":"https://api.github.com/users/binary1230/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/binary1230/subscriptions","organizations_url":"https://api.github.com/users/binary1230/orgs","repos_url":"https://api.github.com/users/binary1230/repos","events_url":"https://api.github.com/users/binary1230/events{/privacy}","received_events_url":"https://api.github.com/users/binary1230/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-02T12:42:11Z","updated_at":"2015-06-02T13:45:08Z","closed_at":null,"body":"We don't need this 100% just yet because all of magfest and AC are working out of public repos, but....\r\n\r\nNeed support for: Cloning a non-public repo from github and need an SSH key to access it.\r\n\r\nDocker builds can't use ENV vars or mount VOLUMES, so really the only way to get an SSH key into the container being built is to add the host's SSH key into the docker context.  I had an example of this in my first revision Dockerfile:\r\n\r\n```\r\nADD id_rsa /root/.ssh/id_rsa\r\nRUN /bin/echo -e \"Host github.com\\n\\tStrictHostKeyChecking no\\n\" >> ~/.ssh/config\r\n```\r\n\r\nThere's an issue here though, which is, the ADD command is now inserting data into the container which gets saved in a aufs layer forever and could be extracted by an attacker with access to the final image. (*I think*)\r\n\r\nThere is vigorous debate in the Docker project about this very topic:\r\nhttps://github.com/docker/docker/pull/9176\r\n\r\nThe short version is Docker design philosophy is that they don't want builds to depend on any external context, so they can be completely self-contained and reproducible.  So this creates issues when you need context to be present in order to do certain things, like having external SSH keys present in order to clone repositories."},"comment":{"url":"https://api.github.com/repos/magfest/ubersystem-docker/issues/comments/107957525","html_url":"https://github.com/magfest/ubersystem-docker/issues/7#issuecomment-107957525","issue_url":"https://api.github.com/repos/magfest/ubersystem-docker/issues/7","id":107957525,"user":{"login":"thaeli","id":384634,"avatar_url":"https://avatars.githubusercontent.com/u/384634?v=3","gravatar_id":"","url":"https://api.github.com/users/thaeli","html_url":"https://github.com/thaeli","followers_url":"https://api.github.com/users/thaeli/followers","following_url":"https://api.github.com/users/thaeli/following{/other_user}","gists_url":"https://api.github.com/users/thaeli/gists{/gist_id}","starred_url":"https://api.github.com/users/thaeli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaeli/subscriptions","organizations_url":"https://api.github.com/users/thaeli/orgs","repos_url":"https://api.github.com/users/thaeli/repos","events_url":"https://api.github.com/users/thaeli/events{/privacy}","received_events_url":"https://api.github.com/users/thaeli/received_events","type":"User","site_admin":false},"created_at":"2015-06-02T13:45:08Z","updated_at":"2015-06-02T13:45:08Z","body":"Per discussion in chat - we aren't going to use this in production, so this isn't critical path. If someone wants to implement this in the future, the proper Docker method would be to use ADD instead of git clone for the private layer, and thereby build from their working copy instead of git."}}