Hi,
At work we’re behind a firewall, we build Julia code into docker images, and we now have a private registry and some packages on Bitbucket (thanks to LocalRegistry.jl!)
This combination, along with some documented (but as far as I can tell not yet fixed?), issues with Libgit2 make for almost more fun than I can cope with, and it would be nice to get a review of my approach.
I have a very shaky working solution, which relies on on installing ssh into the base Julia image and using it to get an authorized key for bitbucket and to run ssh-agent.
I have a couple of questions related to this particular way of doing things below, but mainly I’d like to check that I’m not missing better ways of achieving the same thing?
For the way I’m doing it now, it would be nice to tell Libgit2 the equivalent of
Host altssh.bitbucket.org
StrictHostKeyChecking no
But it doesn’t read ~/.ssh/config. Is there a way of passing this kind of configuration information in or a better way to do this?
It would also be nice to point Libgit2 to the the key file rather than start ssh-agent but I can’t get
env SSH_KEY_PATH=/root/.ssh/id_rsa julia "using Pkg; Pkg..."
to work at all. Any pointers on that?
Thanks!
Geoff
If it’s helpful, an only-just-working docker file is something like this:
FROM julia:latest
COPY id_rsa /root/.ssh/id_rsa
RUN chmod go-rwx /root/.ssh/id_rsa \
&& echo "Host altssh.bitbucket.org\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config \
&& apt-get update && apt-get install -y ssh
WORKDIR /home
COPY Project.toml Project.toml
COPY src/ src/
# Run ssh just to get an authorized key
# I believe I could also `ssh-keyscan altssh.bitbucket.org:443 >> /root/.ssh/known_hosts` but that might be interactive?
RUN ssh -T -p 443 git@altssh.bitbucket.org \
# Start ssh-agent because libgit2 doesn't find the key by itself
&& eval "$(ssh-agent -s)" \
&& ssh-add /root/.ssh/id_rsa \
# `dev` our package before `instantiate` by providing the URL, because the registry URLs aren't ssh URLs
&& julia --project=@. -e"using Pkg;
Pkg.develop(PackageSpec(url=\"ssh://git@altssh.bitbucket.org:443/package/Url.jl.git\")); Pkg.instantiate(); try; Pkg.precompile(); catch e; end"
A couple of things to note:
- that’s not a great way of passing the key in, but that’s not my main issue at the moment.
- our firewall blocks 22 so we have to connect to Bitbucket through altssh on 443.
- I’m doing the
Pkg.developbecause currently our private registry contains https URLs. I haven’t managed to get thessh-agentkey-finding trick for Libgit2 working on Windows, so outside of docker we need we have to use https URLs for Pkg to work. Hopefully a later version will be:
julia --project=@. -e"using Pkg; Pkg.Registry.add(RegistrySpec(url="registry_url")); Pkg.instantiate(); ...