From 2edbeac2127b684f00d7deb3b78e98dbb2b260e6 Mon Sep 17 00:00:00 2001 From: Conan Scott Date: Mon, 2 Feb 2026 03:08:14 +0000 Subject: [PATCH] Fix: Persist SSH host keys in /data/ssh --- Dockerfile | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1a61766..d807d46 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,15 +10,14 @@ RUN apt-get update && apt-get install -y curl wget git jq un RUN wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq && chmod +x /usr/bin/yq # Setup SSH directory & Config for OpenShift (Random UID support) -RUN mkdir -p /var/run/sshd && mkdir -p /etc/ssh/host_keys && chmod 775 /var/run/sshd && chmod 775 /etc/ssh/host_keys +# PID file still needs to be in a transient writable spot +RUN mkdir -p /var/run/sshd && chmod 775 /var/run/sshd # Custom sshd_config for non-root usage -RUN echo "Port 2222\nPermitRootLogin no\nPasswordAuthentication no\nPubkeyAuthentication yes\nPidFile /var/run/sshd/sshd.pid\nHostKey /etc/ssh/host_keys/ssh_host_rsa_key\nHostKey /etc/ssh/host_keys/ssh_host_ecdsa_key\nHostKey /etc/ssh/host_keys/ssh_host_ed25519_key\nAuthorizedKeysFile .ssh/authorized_keys\nChallengeResponseAuthentication no\nUsePAM yes\nSubsystem sftp /usr/lib/openssh/sftp-server" > /etc/ssh/sshd_config +# POINTS TO PERSISTENT VOLUME (/data/ssh) for host keys +RUN echo "Port 2222\nPermitRootLogin no\nPasswordAuthentication no\nPubkeyAuthentication yes\nPidFile /var/run/sshd/sshd.pid\nHostKey /data/ssh/ssh_host_rsa_key\nHostKey /data/ssh/ssh_host_ecdsa_key\nHostKey /data/ssh/ssh_host_ed25519_key\nAuthorizedKeysFile .ssh/authorized_keys\nChallengeResponseAuthentication no\nUsePAM yes\nSubsystem sftp /usr/lib/openssh/sftp-server" > /etc/ssh/sshd_config # Create a user 'claw' with sudo access -# Passwordless sudo allowed for friction-free automation -# OpenShift runs as random UID, but 'claw' gives us a named user for direct exec if needed -# We also chmod the home dir to allow group access (OpenShift random UID runs as root group) RUN useradd -m -s /bin/bash claw && echo "claw ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers && chmod -R g+rwX /home/claw # Prepare volume mount point @@ -34,5 +33,5 @@ WORKDIR /data EXPOSE 2222 # Start SSH daemon -# Fix: Explicitly generate keys into the custom host_keys directory -CMD ["/bin/bash", "-c", "ssh-keygen -f /etc/ssh/host_keys/ssh_host_rsa_key -N '' -t rsa && ssh-keygen -f /etc/ssh/host_keys/ssh_host_ecdsa_key -N '' -t ecdsa && ssh-keygen -f /etc/ssh/host_keys/ssh_host_ed25519_key -N '' -t ed25519 && /usr/sbin/sshd -D -f /etc/ssh/sshd_config"] \ No newline at end of file +# Logic: Check for persistent keys in /data/ssh. If missing, generate them. +CMD ["/bin/bash", "-c", "mkdir -p /data/ssh && if [ ! -f /data/ssh/ssh_host_rsa_key ]; then echo 'Generating persistent host keys...'; ssh-keygen -f /data/ssh/ssh_host_rsa_key -N '' -t rsa; ssh-keygen -f /data/ssh/ssh_host_ecdsa_key -N '' -t ecdsa; ssh-keygen -f /data/ssh/ssh_host_ed25519_key -N '' -t ed25519; fi && /usr/sbin/sshd -D -f /etc/ssh/sshd_config"] \ No newline at end of file