碼頭工人：去從私人GitHub回購

Question

我想運行一個容器，將暴露一個包，我有一個私人的GitHub回購一個golang服務。

由於我與GCE合作，我的初始圖像是google/debian：wheezy。

安裝所有需要的依賴關係和工具後，我運行

RUN go get github.com/<my_org>/<my_package> 

所在的包是私人回購協議。

我已經加入我的GitHub SSH密鑰允許從私人回購協議泊塢窗文件的克隆：

ADD priv/id_rsa /root/.ssh/id_rsa 
ADD priv/id_rsa.pub /root/.ssh/id_rsa.pub 

不過，我在得到一個錯誤的去把過程當去試圖克隆回購：

# cd .; git clone https://github.com/<my_org>/<my_package> /gopath/src/github.com/<my_org>/<my_package> 
Cloning into '/gopath/src/github.com/<my_org>/<my_package>'... 
fatal: could not read Username for 'https://github.com': No such device or address 
package github.com/<my_org>/<my_package>: exit status 128 

要調試的問題，從Dockerfile，我運行：

RUN ssh-keyscan -t rsa github.com 2>&1 >> /root/.ssh/known_hosts 

這告訴我有一些問題。它看起來像驗證私鑰是好的，但公鑰上有些奇怪的事情發生。這是完整的ssh-鍵掃描結果：

OpenSSH_6.0p1 Debian-4+deb7u2, OpenSSL 1.0.1e 11 Feb 2013 
Pseudo-terminal will not be allocated because stdin is not a terminal. 
debug1: Reading configuration data /etc/ssh/ssh_config 
debug1: /etc/ssh/ssh_config line 19: Applying options for * 
debug1: Connecting to github.com [192.30.252.129] port 22. 
debug1: Connection established. 
debug1: permanently_set_uid: 0/0 
debug1: identity file /root/.ssh/id_rsa type 1 
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 
debug1: identity file /root/.ssh/id_rsa-cert type -1 
debug1: identity file /root/.ssh/id_dsa type -1 
debug1: identity file /root/.ssh/id_dsa-cert type -1 
debug1: identity file /root/.ssh/id_ecdsa type -1 
debug1: identity file /root/.ssh/id_ecdsa-cert type -1 
debug1: Remote protocol version 2.0, remote software version libssh-0.6.0 
debug1: no match: libssh-0.6.0 
debug1: Enabling compatibility mode for protocol 2.0 
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2 
debug1: SSH2_MSG_KEXINIT sent 
debug1: SSH2_MSG_KEXINIT received 
debug1: kex: server->client aes128-ctr hmac-sha1 none 
debug1: kex: client->server aes128-ctr hmac-sha1 none 
debug1: sending SSH2_MSG_KEX_ECDH_INIT 
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY 
debug1: Server host key: RSA 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48 
debug1: Host 'github.com' is known and matches the RSA host key. 
debug1: Found key in /root/.ssh/known_hosts:1 
Warning: Permanently added the RSA host key for IP address '192.30.252.129' to the list of known hosts. 
debug1: ssh_rsa_verify: signature correct 
debug1: SSH2_MSG_NEWKEYS sent 
debug1: expecting SSH2_MSG_NEWKEYS 
debug1: SSH2_MSG_NEWKEYS received 
debug1: Roaming not allowed by server 
debug1: SSH2_MSG_SERVICE_REQUEST sent 
debug1: SSH2_MSG_SERVICE_ACCEPT received 
debug1: Authentications that can continue: publickey 
debug1: Next authentication method: publickey 
debug1: Offering RSA public key: /root/.ssh/id_rsa 
debug1: Server accepts key: pkalg ssh-rsa blen 279 
debug1: key_parse_private_pem: PEM_read_PrivateKey failed 
debug1: read PEM private key done: type <unknown> 
debug1: read_passphrase: can't open /dev/tty: No such device or address 
debug1: Trying private key: /root/.ssh/id_dsa 
debug1: Trying private key: /root/.ssh/id_ecdsa 
debug1: No more authentication methods to try. 
Permission denied (publickey). 

我曾嘗試搭配chmod 600和上私法/公共密鑰文件模式700，這並沒有幫助。

任何線索？有人成功運行去獲取從docker的debian上的私人回購？

Answer 1

我在經過一些黑客攻擊後發現了這一點。這不是一個理想的解決方案，因爲它涉及安裝SSH，並在容器中構建私鑰。本示例基於官方Docker golang image（Debian Wheezy）：

與您的示例的主要區別在於，您需要使用git config命令強制使用ssh而不使用默認的https。

FROM golang 

RUN apt-get update && apt-get install -y ca-certificates git-core ssh 

ADD keys/my_key_rsa /root/.ssh/id_rsa 
RUN chmod 700 /root/.ssh/id_rsa 
RUN echo "Host github.com\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config 
RUN git config --global url.ssh://git@github.com/.insteadOf https://github.com/ 

ADD . /go/src/github.com/myaccount/myprivaterepo 

RUN go get github.com/myaccount/myprivaterepo 
RUN go install github.com/myaccount/myprivaterepo 

Answer 2

go get正試圖使用​​https，完全忽略ssh。

你將不得不設置~/.netrc：

ADD priv/.netrc /root/.netrc 

凡NETRC樣子：

machine github.com login github-username password github-password 

裁判：

• https://stackoverflow.com/a/13724351/145587

Answer 3

在闡述OneOfOne的~/.netrc答案，這就是我與詹金斯在Linux上做：

FROM golang:1.6 

ARG GITHUB_USER=$GITHUB_USER 
ARG GITHUB_PASS=$GITHUB_PASS 

# Copy local package files to the container's workspace. 
ADD . /go/src/github.com/my-org/my-project 
WORKDIR /go/src/github.com/my-org/my-project/ 

# Build application inside the container. 
RUN echo "machine github.com\n\tlogin $GITHUB_USER\n\tpassword $GITHUB_PASS" >> ~/.netrc && \ 
    go get github.com/tools/godep && \ 
    go get github.com/onsi/ginkgo/ginkgo && \ 
    godep restore && \ 
    ginkgo -r --randomizeAllSpecs --randomizeSuites --failOnPending && \ 
    godep go install && \ 
    rm -f ~/.netrc 

ENTRYPOINT /go/bin/my-project 

EXPOSE 8080 

泊塢窗生成命令是：

docker build \ 
    --build-arg GITHUB_USER=xxxxx \ 
    --build-arg GITHUB_PASS=yyyyy \ 
    -t my-project . 

兩個ARG指令映射--build-arg所以碼頭工人可以在Dockerfile中使用它們。

第一行和最後一行RUN創建並刪除~/.netrc。

在Jenkins中，我在構建命令中使用了git pull中的相同聲明。

在此策略中，碼頭構建過程中密碼未被回顯，也未保存在泊塢窗圖像的任何圖層上。另外請注意，在構建期間將銀杏測試結果打印到控制檯。