Docker SSH

Access private repos when building Docker images.

Do note that this guide works only with Github, but with slight modifications it can easily be adapted to GitLab and others.

Prerequisites

Install the following tools:

• Docker >= 19.03.13
• buildx >= v0.4.1

Enable the experimental features for Docker CLI by adding the following config to ~/.docker/config.json:

{
    "experimental": "enabled"
}

And enable the experimental features for Docker Daemon by adding the following config to the /etc/docker/daemon.json file (for Linux; on macOS it's ~/.docker/daemon.json):

{
    "experimental": true
}

Start the ssh-agent:

eval $(ssh-agent)

And add your current SSH key to the agent:

ssh-add ~/.ssh/id_rsa

Lastly, setup the known_hosts to avoid prompts from SSH:

ssh-keyscan github.com >> ./known_hosts

NOTE: On Linux, you probably don't need to start the agent as it should be started at login.

Build

Build a base image that just clones a private repo (we'll use this in another image):

docker buildx build -f Dockerfile.priv-repo \
    --ssh default \
    --secret id=known_hosts,src=./known_hosts \
    --build-arg PRIV_GIT_REPO=<my private repo> \
    --tag priv-repo \
    .

Or build the base image with bake:

PRIV_GIT_REPO=<my private repo> docker buildx bake priv-repo

Now build an image that just copies whatever was in the private repo to the host:

docker buildx build -f Dockerfile -o type=local,dest=./priv-code .

Or build the image with bake:

docker buildx bake

SSH Auth

Note that the Github CI workflow is setup to use deploy keys instead of a user SSH key. Read more about security in workflows at security hardening for github actions.