containers/ws: Support using an external SSH agent

[engelant]

In unprivileged mode, support to an already running SSH agent
for sharing SSH private keys.

Thanks to Anton Engelhardt [email protected] for the idea and
initial implementation sketch!

Fixes #21170

ws container: Support sharing host ssh-agent

For SSH key authentication, the cockpit/ws container has supported bind-mounting private SSH keys into the container for a long time. That mode is appropriate for server system containers or deploying in e.g. Kubernetes.

For desktop use cases similar to Cockpit Client it is preferable to instead run the ws container as your own user, and share your user session's SSH agent. This provides a more comfortable login experience as you don't have to unlock private keys with your passphrases on the Cockpit login page again, and this also avoids exposing the private key to the web server.

Please see the "SSH authentication: Share SSH agent with container" section in the container documentation for details.

[martinpitt]

Thanks! This also needs an integration test, but I'm happy to create that - unless you want to, of course!

[martinpitt]

@engelant Do you still want to continue with this? No pressure, we all have other work to do, I was just curious if you lost interest or just don't have time. I.e. I can finish this at some point too, just don't want to step on your toes.

[engelant]

@martinpitt terribly sorry for the long response time, but yeah stuff...

Anyhow, as for the selinux part,, :z is propably insufficent, as this only affects the mount ns and not the ipc one afaik.
Imho this useage example is kind of out of scope, or I would just go with the --privileged for now.

Further more the integration tests, I'm not sure what's required there.
So if you want to drag this over the finish line here I'd very much welcome that.

[martinpitt]

@engelant Took me a while to find some time to work this out, but I think I've got something now. Please have a look at let me know if this works for you? Thanks for the idea, this is really neat!

fixed up, and now it's my code

[jelly]

So the only concern here is that I don't know what happens when the ssh socket dies we might get some unhandled errors?

[martinpitt]

Not "unhandled" as such, you just get the same behaviour as with the ssh command line: if the agent isn't available, it falls back to other auth mechanisms like user+password. I think that's okay?