dockerexec

Documentation

Overview

Package dockerexec provides ContainerExecConfig.

Index

• Variables
• func FindContainerKeys(cli client.APIClient, container types.Container, options SSHAuthOptions) (keys []ssh.PublicKey)
• func FindUniqueContainer(cli client.APIClient, key string, value string) (container types.Container, err error)
• type ContainerExecConfig
  • func (cfg *ContainerExecConfig) Apply(logger logging.Logger, sshserver *ssh.Server) error
  • func (cfg *ContainerExecConfig) Handle(logger logging.Logger, session ssh.Session) (proxyssh.Process, error)
  • func (cfg *ContainerExecConfig) RegisterFlags(flagset *flag.FlagSet)
• type ContainerExecProcess
  • func NewContainerExecProcess(client client.APIClient, containerID string, command []string) *ContainerExecProcess
  • func (cep *ContainerExecProcess) Cleanup() (killed bool)
  • func (cep *ContainerExecProcess) Init(ctx context.Context, detector logging.MemoryLeakDetector, isTerm bool) error
  • func (cep *ContainerExecProcess) Start(detector logging.MemoryLeakDetector, Term string, ...) (*os.File, error)
  • func (cep *ContainerExecProcess) String() string
  • func (cep *ContainerExecProcess) Wait(detector logging.MemoryLeakDetector) (code int, err error)
• type SSHAuthOptions

Variables

var ErrContainerNotUnique = errors.New("No unique container found")

ErrContainerNotUnique is an error that is returned when a container is not unique

Functions

func FindContainerKeys

func FindContainerKeys(cli client.APIClient, container types.Container, options SSHAuthOptions) (keys []ssh.PublicKey)

FindContainerKeys finds the public keys desired by a particular container and returns them

Location of stored credentials is determined by options.

This function will ignore all errors and or invalid values.

func FindUniqueContainer

func FindUniqueContainer(cli client.APIClient, key string, value string) (container types.Container, err error)

FindUniqueContainer finds a unique running container with the given label key and value

If there is no unique runing container, returns ErrContainerNotUnique. If something goes wrong, other errors may be returned.

Types

type ContainerExecConfig

type ContainerExecConfig struct {

	// Client is the docker client to be used to the docker daemon.
	Client client.APIClient

	// DockerLabelUser is the label to use for associating a user to a container.
	DockerLabelUser string

	// DockerLabelAuthFile is the label of a container that may contain paths to authorized_keys files.
	DockerLabelAuthFile string

	// DockerLabelKey is the label that may contain an authorized_key for a user.
	DockerLabelKey string

	// ContainerShell is the executable to run within the container.
	ContainerShell string
}

ContainerExecConfig implements a proxyssh.Configuration and proxyssh.Handler that execute user processes within running docker containers. For this purpose it makes use of 'docker exec'.

The association of incoming user to a docker container happens via the username. To find a docker container, the server looks for a docker container where a specific label has a value equal to the username. If there is no running docker container with the provided label (or there is more than one) the connection will fail.

To authenticate a user, the server uses ssh keys. A user is considered authenticated if they can prove the ownership of at least one of the ssh keys associated with this user. To find the ssh keys associated to a user, the server uses labels on the associated docker container. However in this case, two different labels are checked.

One label can contain an ssh key (in authorized_keys) format. The second label may contain comma-seperated file paths. These file paths are interpreted relative to the filesystem of the docker container. Each file (if it exists) may contain several ssh public keys (in authorized_keys format).

Once a user is authenticated, a session within the associated container will be started. For this, a process inside the docker container (called the shell) will be started. When no arguments are provided, it will run the shell without any arguments. When some arguments are provided by the user, it will run the shell with two arguments, '-c' and a concatination of the arguments provided.

For example, assume the shell is '/bin/sh' and the command provided by the user is 'whoami'. Then the server will execute the command '/bin/sh -c whoami' inside the container.

When the ssh user requested a tty, a tty will be allocated within the container. When no tty was requested, none will be allocated.

Both the shell and labels to be used can be configured via opts.

func (*ContainerExecConfig) Apply

func (cfg *ContainerExecConfig) Apply(logger logging.Logger, sshserver *ssh.Server) error

Apply applies this configuration to the server.

func (*ContainerExecConfig) Handle

func (cfg *ContainerExecConfig) Handle(logger logging.Logger, session ssh.Session) (proxyssh.Process, error)

Handle implements the handler

func (*ContainerExecConfig) RegisterFlags

func (cfg *ContainerExecConfig) RegisterFlags(flagset *flag.FlagSet)

RegisterFlags registers flags representing the config to the provided flagset. When flagset is nil, uses flag.CommandLine.

type ContainerExecProcess

type ContainerExecProcess struct {

	// internal streams
	term.Pipes
	// contains filtered or unexported fields
}

ContainerExecProcess represents a process running inside a docker engine

func NewContainerExecProcess

func NewContainerExecProcess(client client.APIClient, containerID string, command []string) *ContainerExecProcess

NewContainerExecProcess creates a process that executes within a docker container.

The command will not prefix the entrypoint.

func (*ContainerExecProcess) Cleanup

func (cep *ContainerExecProcess) Cleanup() (killed bool)

Cleanup cleans up this process, typically to kill it.

func (*ContainerExecProcess) Init

func (cep *ContainerExecProcess) Init(ctx context.Context, detector logging.MemoryLeakDetector, isTerm bool) error

Init initializes this EngineProcess

func (*ContainerExecProcess) Start

func (cep *ContainerExecProcess) Start(detector logging.MemoryLeakDetector, Term string, resizeChan <-chan proxyssh.WindowSize, isPty bool) (*os.File, error)

Start starts this process

func (*ContainerExecProcess) String

func (cep *ContainerExecProcess) String() string

String turns EngineProcess into a string

func (*ContainerExecProcess) Wait

func (cep *ContainerExecProcess) Wait(detector logging.MemoryLeakDetector) (code int, err error)

Wait waits for the process and returns the exit code

type SSHAuthOptions

type SSHAuthOptions struct {
	// If set, check if a candidate container contains an ssh key in the provided label
	LabelKey string

	// If set, check if a candidate container contains an authorized_keys file at the provided path(s)
	// Paths may be an array seperated by commas.
	LabelFile string
}

SSHAuthOptions contain options that configure authentication via ssh