/sshd-docker

Fargate has no host. Let's add sshd so we can get into the container.

Primary LanguageDockerfile

sshd Docker Example

Adding sshd to docker is considered an anti-pattern except in the case of AWS Fargate as highlighted by a long standing issue.

This repo is an example of how to get docker running effectively for Alpine to use in Fargate.

To Run

  1. Add your public key to authorized-keys/
  2. docker build -t openssh .
  3. docker run -p 2222:22 -it openssh /bin/sh -c "SSH_ENABLED=true /usr/local/bin/docker-entrypoint.sh && sleep infinity"
  4. ssh -i ~/path/to/private_key -p 2222 root@localhost

Practical Fargate

To be realistically accessible while still being secure, sshd should remain off until necessary.

  • Leave SSH_ENABLED environment variable false for all containers.

  • Create an extra ECS Cluster as a One-Off Fargate task whose sole purpose is to be the SSH connector. Cloudformation CMD becomes:

    ...
ContainerDefinitions:
  ...
  Command:
    - /bin/sh
    - '-c'
    - "SSH_ENABLED=true /usr/local/bin/docker-entrypoint.sh && sleep infinity"

    or if manually creating in AWS Fargate UI for container definitions:

    /bin/sh,-c,SSH_ENABLED=true /usr/local/bin/docker-entrypoint.sh && sleep infinity

  • Now, there is now on-demand SSH. Be sure to stop the task when finished.

  • Use a Bastion/Jump machine.

Notes

  • SSH_ENABLED flag turns on/off sshd. Default: false
  • SSH wipes the environment - the trick is to re-hydrate the session via env | grep '_\|PATH' | awk... in the entry-point.sh
    • Change _\|PATH to capture the envs you need. Keep in mind you don't want all of them (some session ones do weird things to the terminal). Ideally all your envs have _ in them.
  • Fargate does not let HostPort and ContainerPort be different. This means only one container can expose 22 at a time. Hard limitation.
  • Assumes you connect into your container to root.
  • Key management is not the point of this repo, manage your keys well please.
  • sleep infinity is cool.

Suggestions Welcome

Improvements to the files or to the Practical Fargate section are always welcomed.