newsnowlabs / dockside

Develop, stage and test on-prem or in your private cloud. Dockside is a tool for provisioning lightweight access-controlled IDEs, staging environments and sandboxes - aka 'devtainers' - on local machine, on-premises raw metal or VM, or in the cloud
https://dockside.io/
Apache License 2.0
266 stars 16 forks source link

Allow ssh access to devtainers #17

Closed struanb closed 9 months ago

struanb commented 1 year ago

Here is a pull request for allowing fully-managed ssh access to devtainers.

There's a few little FIXMEs in the branch that should be resolved, but it will be easier to discuss these in the context of the whole branch:

  1. Should a devtainer owner's details (name, email, ssh secrets) be exposed in a devtainer's filesystem (in /tmp/dockside launch logs) as a matter of course. In practice all of these details may be written to the filesystem (.gitconfig, .ssh/authorized_keys) but there may be exceptional cases where this is not needed or desired.
  2. The patched-dockside requires a volume or bind mount at /opt/dockside/host on the Dockside container. An anonymous volume will be mounted there automatically (thanks to VOLUME directive in the Dockerfile). This volume is used to store an sshd host key that all devtainers can share. It will be identified by Dockside and remounted read-only into each devtainer.
    1. If however when Dockside is launching the volume is not read-write, and there is no host key, should Dockside throw an error? That's the current logic, but there may be edge cases, such as launching Dockside in Dockside, which should be supported.
    2. If when launching a new devtainer, Dockside cannot identify a bind-mount or volume at /opt/dockside/host, should it throw an error or continue to launch the devtainer but without the mount? Are there any edge-cases?
  3. launch.sh compatibility: is it possible for a new devtainer to be launched with an older launch.sh or vice-versa, and if so does everything work or fail gracefully? Devtainers should consistently launch, especially on Dockside upgrade but also where possible on downgrade (e.g. when launching a devtainer we would not want, the new wstunnel or dropbear binaries not to be found, or if not found for this not to be handled gracefully).
struanb commented 11 months ago

We've pushed the latest code and docs to https://github.com/newsnowlabs/dockside/tree/devel-ssh-prerelease and built a prerelease Docker image, newsnowlabs/dockside:devel-ssh-prerelease.

This prerelease is essentially commit https://github.com/newsnowlabs/dockside/commit/8a94c67737d9a584df220b4403a1ba0ac1dc4333:

Integrated SSH server support
- Provisions an SSH and a wstunnel daemon for each devtainer allowing
  any authorised developer to SSH in
- Maintenance of `~/.ssh/authorized_keys` file for the devtainer owner
  and other developers with whom the devtainer is shared
- One-click SSH from the Dockside UI
- wstunnel helper setup instructions integrated in the Dockside UI
- Facilitates use of any terminal editor or command line tool including
  those that benefit from key forwarding, such as `git`;
- Facilitates seamless
  [VS Code remote development](https://code.visualstudio.com/docs/remote/ssh)
  via the
  [Remote SSH](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-ssh)
  extension.

Dockside now enables SSH by default for all new devtainers.

To try it, follow the install instructions in the README on the prerelease branch (the docker run command has changed slightly), substituting this prerelease image name newsnowlabs/dockside:devel-ssh-prerelease for newsnowlabs/dockside in your docker run command.

For instructions on enabling, configuring, disabling SSH and technical details, see https://github.com/newsnowlabs/dockside/blob/devel-ssh-prerelease/docs/extensions/ssh.md.

struanb commented 9 months ago

Integrated support for SSH, VS Code & GitHub Copilot

This update offers integrated SSH server support, and indirectly support for VS Code server and GitHub Copilot.

Dockside now facilitates:

Dockside achieves this through:

N.B. Dockside now enables SSH access by default for all new devtainers, though this can be disabled by setting ssh.default=0 in config.json. See documentation for full details on configuring Dockside for SSH access and see the new Dockside UI for details on configuring clients to tunnel ssh over wstunnel.

WARNING: Dockside now takes over control of ~/.ssh/authorized_keys in new devtainers. Accordingly, SSH support is not compatible with any profiles that mount over this file (or over ~/.ssh if the mounted filesystem contains an authorized_keys file). You should take care to disable SSH in such profiles as, otherwise, if you make changes manually to this file on a devtainer that has SSH enabled, your changes may be lost.