mirror of
https://github.com/apache/airflow.git
synced 2026-11-04 15:53:05 +00:00
Ramit Kataria
51ebe32acc
When Breeze runs with --forward-credentials, the host's ~/.ssh is bind-mounted read-write at /root/.ssh and the container start used to operate on it directly. Every start overwrote the user's id_rsa with a throwaway key, appended that key to authorized_keys and three localhost entries to known_hosts (observed to accumulate hundreds of entries), left a dangling authorized_keys2 symlink, and ran 'chmod 600 ~/.ssh/*'. That chmod also strips the execute bit from the ~/.ssh/agent directory that OpenSSH 10.x uses for agent sockets. On macOS this kills the launchd-managed ssh-agent and, after the next reboot, makes every ssh on the host hang waiting on the dead agent socket. The ssh-to-localhost setup, which the real-connection SSH and SFTP provider tests rely on, now lives entirely in /root/.breeze-ssh, a path that is never mounted from the host. sshd accepts the generated key via an sshd_config.d drop-in, the OpenSSH client finds it via an ssh_config.d drop-in, and paramiko-based hooks, which read neither, discover it through an ssh-agent started by the entrypoint. entrypoint_exec.sh exports the agent socket so 'breeze exec' shells get it too. The authorized_keys2 symlink had no consumers anywhere in the repo and is dropped.
34 lines
1.4 KiB
Bash
Executable File
34 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
# shellcheck source=scripts/in_container/_in_container_script_init.sh
|
|
. /opt/airflow/scripts/in_container/_in_container_script_init.sh
|
|
|
|
# shellcheck source=scripts/in_container/configure_environment.sh
|
|
. /opt/airflow/scripts/in_container/configure_environment.sh
|
|
|
|
# shellcheck source=scripts/in_container/run_init_script.sh
|
|
. /opt/airflow/scripts/in_container/run_init_script.sh
|
|
|
|
# Reuse the ssh-agent started by entrypoint_ci.sh so that ssh-ing to localhost also
|
|
# works in shells entered with `breeze exec`.
|
|
if [[ -S /root/.breeze-ssh/agent.sock ]]; then
|
|
export SSH_AUTH_SOCK="/root/.breeze-ssh/agent.sock"
|
|
fi
|
|
|
|
exec /bin/bash "${@}"
|