Plus one for this!

This would be super helpful for me also!

Hello, thanks for reporting @GetOnMyLvl97. Is there a reason why SSH_AUTH_SOCK env var cannot be just passed as --ssh build arg?

Well I don't think so but, there is no option in the current serverless set-up that adds the ssh flag to the docker command as I see it from this article.
https://www.serverless.com/framework/docs/providers/aws/guide/functions#referencing-container-image-as-a-target

The docker command that gets generated is in my case this one

docker build -t serverless:appimage -f ~/lambda_runtime/Dockerfile --build-arg SSH_KEY=$(cat ~/.ssh/id_rsa) ./ --platform=linux/amd64

EDIT:
May I do something wrong? How did you design this to handle fetch from private repos.

Sorry @GetOnMyLvl97, I've missed that it's with --ssh flag not as a build arg. As for the original proposal, maybe it would work with just passing the path to ssh key instead of passing the content as arg? and then just copying it as a part of docker build?

As for using the --ssh flag - it seems like the best solution in general, but it seems to not be supported in all Docker versions and is a niche use case. Please vote with 👍 on the original issue to help us better understand how much interest there is in support for --ssh flag.

Sorry from my side. I should have written flag instead of buildarg... corrected it now.

Well, passing the absolute path to the ssh key instead of passing the content as arg won't work because the absolute path of your resources refers to an absolute path within the build context, not an absolute path on the host os.
It will fail to find the File.
I need to add the ssh-key inside my build directory and copy it inside the image.

COPY ./id_rsa /root/.ssh/id_rsa

Why do you think using ssh is a niche use case? e.g. In my company, we're using our own lambda decorators hosted in a private git repo across all serverless services.

Sorry from my side. I should have written flag instead of buildarg... corrected it now.

No worries, I misread the docker docs!

Well, passing the absolute path to the ssh key instead of passing the content as arg won't work because the absolute path of your resources refers to an absolute path within the build context, not an absolute path on the host os.

What I was thinking of was something along those lines in your Dockerfile:

COPY ${argWithPathToSshKeyOnHost} /root/.ssh/id_rsa

Wouldn't that work? I might be missing something here of course

Why do you think using ssh is a niche use case? e.g. In my company, we're using our own lambda decorators hosted in a private git repo across all serverless services.

Of course, I might be mistaken here, but when I used Docker more extensively in the past, the checkout of git repo that the contents of were later baked into image usually happened before docker build and checked out files were "just" COPYied during build process. Is there a specific reason why you need to fetch git repos as a part of docker build process?

btw, I'm not saying one or the other is better/worse, I'm trying to understand the use case as much as I can 👍

COPY ${argWithPathToSshKeyOnHost} /root/.ssh/id_rsa
failed to compute cache key: "/Users/ec2-user/.ssh/id_rsa" not found: not found

All the resources need to be in the dir that you run the build, i.e. where your Dockerfile is. You cant use an absolute path from elsewhere, think of it from the build perspective.

For a couple of years, it was a pain in the ass to build dockers with private git but they improved dramatically.
I want to fetch git repos because I install private packages with pip install git+ssh:/******** in my image.

Imagine I would need to clone 4-5 repos in my builddir, copy them into the image and hit for everyone the setup.py. This will add a lot of unnecessary complexity. Instead, I can use the --mount=type=ssh pip install -r requiremenets.txt.

Thanks for the clarification @GetOnMyLvl97 and description of your use case.

Let's gather more feedback on this and we can consider it as a potential feature (the ssh definition). In the meantime, we can discuss how the potential final implementation could look like

Makes sense!

What do you think the implementation could look like?

Hey @GetOnMyLvl97 - yeah, the implementation should probably be similar as for platform - related PR for inspiration: https://github.com/serverless/serverless/pull/10237/files.

One thing that I'm not sure is how the ssh config should be scoped - should it be redefined for each image if you have more of them?

Hey folks, came across this issue as i'm running into the same exact unsolved use case of needing to pip install from private repos. It would be really nice for serverless to support the --ssh build option. Have there been any updates on this front?

As a side note, it would also be nice to support a more general way to pass arbitrary flags to the Docker build process so that each build option doesn't need a sls counterpart. For example, maybe something like extraBuildArgs: "--no-cache --progress=plain" etc.

Any news on this?

We are in desperate needs of a way to pass arbitrary options to the docker build command, particularly --secret

+1 this would be really useful

hey @pgrzesik what do you think about adding buildOptions aside of buildArgs in the ECR config for all sorts of arbitrary options, including ssh and secret options mentioned here?

Potentially solves:
#10712

Hey @martinezpl - I think that makes sense, but I'm not sure if the Serverless team will have capacity to work on that (I'm no longer a part of the team)