Dockerfile to add ssh key of container and host - docker

Question

I want to make a container ssh into the host without asking for the password. For this, I need to save the ssh key. I have following dockerfile:
FROM easypi/alpine-arm
RUN apk update && apk upgrade
RUN apk add openssh
RUN ssh-keygen -f /root/.ssh/id_rsa
RUN ssh-copy-id -i /root/.ssh/id_rsa user#<ipadress of host>
But the problem is the ip address is not constant. So if I use the same image on some other machine, it wont work there. How can I resolve this issue.
Thanks

Answer 1

None of these things should be in your Dockerfile. Putting an ssh private key in your Dockerfile is especially dangerous, since anyone who has your image can almost trivially get the key out.
Also consider that it's unusual to make either inbound or outbound ssh connections from a Docker container at all; they are usually self-contained, all of the long-term state should be described by the Dockerfile and the source control repository in which it lives, and they conventionally run a single server-type process which isn't sshd.
That all having been said: if you really want to do this, the right way is to build an image that expects the .ssh directory to be injected from the host and takes the outbound IP address as a parameter of some sort. One way is to write a shell script that's "the single thing the container does":
#!/bin/sh
usage() {
echo "Usage: docker run --rm -it -v ...:$HOME/.ssh myimage $0 10.20.30.40"
}
if [ -n "$1" ]; then
usage >&2
exit 1
fi
if [ ! -f "$HOME/.ssh" ]; then
usage >&2
exit 1
fi
exec ssh "user#$1"
Then build this into your Dockerfile:
FROM easypi/alpine-arm
RUN apk update \
&& apk upgrade \
&& apk add openssh
COPY ssh_user.sh /usr/bin
CMD ["/usr/bin/ssh_user.sh"]
Now on the host generate the ssh key pair
mkdir some_ssh
ssh-keygen -f some_ssh/id_rsa
ssh-copy-id -i some_ssh/id_rsa user#10.20.30.40
sudo chown root some_ssh
And then inject that into the Docker container at runtime
sudo docker run --rm -it \
-v $PWD/some_ssh:/root/.ssh \
my_image \
ssh_user.sh 10.20.30.40
(I'm pretty sure the outbound ssh connection will complain if the bind-mounted .ssh directory isn't owned by the same numeric user ID that's running the process; hence the chown root above. Also note that you're setting up a system where you have to have root permissions on the host to make a simple outbound ssh connection, which feels a little odd from a security perspective. [Consider that you could put any directory into that -v option and run an interactive shell.])