SSH server

SSH server (sshd)

Adds an OpenSSH server supervised as a native s6-overlay service.

Example Usage

"features": {
    "ghcr.io/wyrd-company/devcontainers/sshd:1": {}
}

Options

Options Id	Description	Type	Default Value
gatewayPorts	Enable other hosts in the same network to connect to the forwarded ports	string	no
version	Currently unused.	string	latest

Usage

The image must use s6-overlay 3 with /init as its entrypoint. Set "overrideCommand": false in devcontainer.json so s6 remains PID 1.

While the some services automates SSH setup (e.g., when using the GitHub CLI for GitHub Codespaces), this may not be the case for other tools and services. Follow these directions to connect to the dev container from these other tools:

1. Connect to your dev container using a desktop tool or CLI that supports the dev container spec (e.g., VS Code client).

2. Put your public key in the container user’s authorized_keys file. Password and root login are disabled, so this is the only way in. Either mount the file from devcontainer.json:

   "mounts": [
     "source=${localEnv:HOME}/.ssh/id_ed25519.pub,target=/home/vscode/.ssh/authorized_keys,type=bind,readonly"
   ]

   Or copy it in from a terminal inside the container:

   mkdir -p ~/.ssh && chmod 700 ~/.ssh
   cat >> ~/.ssh/authorized_keys   # paste the public key, then Ctrl+D
   chmod 600 ~/.ssh/authorized_keys

   …where vscode above is the user you are running as in the container.

3. Forward the SSH port (2222 by default) to your local machine using either the forwardPorts property in devcontainer.json or the user interface in your tool (e.g., you can press F1 or Ctrl/Cmd+Shift+P and select Ports: Focus on Ports View in VS Code to bring it into focus).

4. Use a local terminal (or other tool) to connect to it with the matching private key. e.g.

   ssh -p 2222 -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null vscode@localhost

   …where vscode above is the user you are running as in the container and 2222 after -p is the local address port from step 3.

   The “-o” arguments are optional, but will prevent you from getting warnings or errors about known hosts when you do this from multiple containers/codespaces.

5. Next time you connect to your container, just repeat steps 3 and 4. The key stays authorized as long as the file is present.

Using SSHFS

SSHFS allows you to mount a remote filesystem to your local machine with nothing but a SSH connection. Here’s how to use it with a dev container.

1. Follow the steps in the previous section to ensure you can connect to the dev container using the normal ssh client.

2. Install a SSHFS client.

   • Windows: Install WinFsp and SSHFS-Win.
   • macOS: Use Homebrew to install macFUSE and sshfs-mac: brew install macfuse gromgit/fuse/sshfs-mac
   • Linux: Use your native package manager to install your distribution’s copy of the sshfs package. e.g. sudo apt-get update && sudo apt-get install sshfs

3. Mount the remote filesystem.

   • macOS / Linux: Use the sshfs command to mount the remote filesystem. The arguments are similar to the normal ssh command but with a few additions. For example:

     mkdir -p ~/sshfs/devcontainer
     sshfs "vscode@localhost:/workspaces" "$HOME/sshfs/devcontainer" -p 2222 -o follow_symlinks -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null -C

     …where vscode above is the user you are running as in the container (e.g. codespace, vscode, node, or root) and 2222 after the -p is the same local port you used in the ssh command in step 1.

   • Windows: Press Window+R and enter the following in the “Open” field in the Run dialog:

     \\sshfs.r\vscode@localhost!2222\workspaces

     …where vscode above is the user you are running as in the container and 2222 after the ! is the same local port you used in the ssh command in the previous section.

4. Your dev container’s filesystem should now be available in the ~/sshfs/devcontainer folder on macOS or Linux or in a new explorer window on Windows.

OS Support

This Feature should work on recent versions of Debian/Ubuntu-based distributions with the apt package manager installed.

bash is required to execute the install.sh script.

---

Note: This file was auto-generated from the devcontainer-feature.json. Add additional notes to a NOTES.md.

Ansible

When the Ansible Feature is installed, sshd starts only after the ansible-setup s6-rc oneshot finishes. If the oneshot fails, sshd does not start. This Feature declares installsAfter for the Ansible Feature, so that the ansible-setup service definition exists when this installer runs. The installer adds the dependency only when that definition exists. Without Ansible, startup does not change.

Trademarks

This feature is not affiliated with or endorsed by the OpenBSD project. OpenSSH and its logo are trademarks of the OpenBSD project. All trademarks and copyrights belong to their holders. The logo is used only to identify the software that this feature installs.

Logo: a simplified vector rendering of the OpenSSH Puffy “Top Secret” artwork from the OpenSSH banner, without the riveted backdrop. OpenSSH publishes no vector logo.