[Bug]: SSH_AUTH_SOCK mounting into container doesn't work

[jglogan]

Feature or enhancement request details

As a container user, I can mount a unix socket file into a container, so that I can use the ssh agent on my host from a container.

container run --volume "${SSH_AUTH_SOCK}:/var/run/ssh-auth.sock" --env SSH_AUTH_SOCK=/var/run/ssh-auth.sock ...

Code of Conduct

• I agree to follow this project's Code of Conduct

[dcantah]

If this doesn't work today it's a bug (or somehow got removed which would be news to me 😭)

[dcantah]

It seems to still work:

➜  ./bin/container run --rm -it -v /Users/dcantah/foobarbaz.sock:/guest-socket.sock -v /Users/dcantah/test-programs/bin:/guest-relay alpine:latest ash
Warning! Running debug build. Performance may be degraded.
/ # ls
bin                guest-socket.sock  media              root               sys
dev                home               mnt                run                tmp
etc                lib                opt                sbin               usr
guest-relay      lost+found         proc               srv                var

/ # ./guest-relay/uds-relay
[87 72 65 84 83 32 85 80 10]
[87 72 65 84 83 32 85 80 10]

The program being used in the guest is:

func main() {
	conn, err := net.Dial("unix", "/guest-socket.sock")
	if err != nil {
		log.Fatal(err)
	}
	buf := make([]byte, 4096)
	for {
		n, err := conn.Read(buf)
		if err != nil {
			log.Fatalf("oops it failed %+v", err)
		}
		fmt.Println(buf[:n])
	}
}

and the host is a similarly simple program to just listen on a uds and send a string every 250ms to all clients.

[dcantah]

Feel free to re-open if something doesn't work here for some configuration, this seems to be (somewhat 😆) functional.

[jglogan]

I see this for the use case I described above:

% ls ${SSH_AUTH_SOCK}
/private/tmp/com.apple.launchd.qylZi0PDA7/Listeners

% container run -it --rm --volume "${SSH_AUTH_SOCK}:/var/run/ssh-auth.sock" --env SSH_AUTH_SOCK=/var/run/ssh-auth.sock ubuntu:latest bash
root@3c3908f9-a1de-4ac5-9f36-6f8bf194dab1:/# ls ${SSH_AUTH_SOCK}
ls: cannot access '/var/run/ssh-auth.sock': No such file or directory
root@3c3908f9-a1de-4ac5-9f36-6f8bf194dab1:/#

[dcantah]

Deduced this down to mounting in symlink paths is wrong today (/var/run is a symlink to /run, and just doing /run/my-cool-socket.sock works fine), although there's another issue in that the manner in which the sockets are mounted is a bit wonky today and could lead to other bugs. Will look into fixes over in cz land

[jglogan]

@dcantah Created apple/containerization#256.

[dcantah]

Fixed via apple/containerization#568 (which is in the CZ we have a dep on here now).