blocks|key|123074|text|我的钥匙是受密码保护的，这是导致问题的原因，下面列出了一个工作文件(为了给未来的谷歌用户提供帮助)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|123075|FROM+ubuntu

MAINTAINER+Luke+Crooks+"luke@pumalo.org"

#+Update+aptitude+with+new+repo
RUN+apt-get+update

#+Install+software+
RUN+apt-get+install+-y+git
#+Make+ssh+dir
RUN+mkdir+/root/.ssh/

#+Copy+over+private+key,+and+set+permissions
#+Warning!+Anyone+who+gets+their+hands+on+this+image+will+be+able
#+to+retrieve+this+private+key+file+from+the+corresponding+image+layer
ADD+id_rsa+/root/.ssh/id_rsa

#+Create+known_hosts
RUN+touch+/root/.ssh/known_hosts
#+Add+bitbuckets+key
RUN+ssh-keyscan+bitbucket.org+>>+/root/.ssh/known_hosts

#+Clone+the+conf+files+into+the+docker+container
RUN+git+clone+git@bitbucket.org:User/repo.git|code-block|syntax|javascript|123076|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

My key was password protected which was causing the problem, a working file is now listed below (for help of future googlers)

<pre><code>FROM ubuntu

MAINTAINER Luke Crooks "luke@pumalo.org"

# Update aptitude with new repo
RUN apt-get update

# Install software 
RUN apt-get install -y git
# Make ssh dir
RUN mkdir /root/.ssh/

# Copy over private key, and set permissions
# Warning! Anyone who gets their hands on this image will be able
# to retrieve this private key file from the corresponding image layer
ADD id_rsa /root/.ssh/id_rsa

# Create known_hosts
RUN touch /root/.ssh/known_hosts
# Add bitbuckets key
RUN ssh-keyscan bitbucket.org &gt;&gt; /root/.ssh/known_hosts

# Clone the conf files into the docker container
RUN git clone git@bitbucket.org:User/repo.git
</code></pre>

blocks|key|4629202|text|对于bitbucket存储库，生成对存储库和项目具有读取访问权限的应用程序密码(Bitbucket设置->访问管理->应用程序密码，见下图)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4629203|​|4629204|📷|atomic|offset|length|4629205|4629206|那么你应该使用的命令是：|4629207|git+clone+https://username:generated_password@bitbucket.org/reponame/projectname.git|code-block|syntax|javascript|4629208|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/2055815dc05129e6ea5832ce9ddadff5.png|imageAlt^0|0|0|0|1|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|10|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|11|8|@]|9|@$G|12|H|13|1|14]]|A|$]]|$1|I|3|C|5|6|7|15|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|16|8|@]|9|@]|A|$]]|$1|L|3|M|5|N|7|17|8|@]|9|@]|A|$O|P]]|$1|Q|3|-4|5|6|7|18|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X|Y|-4]]]]

For bitbucket repository, generate App Password (Bitbucket settings -> Access Management -> App Password, see the image) with read access to the repo and project.

<a href="https://i.stack.imgur.com/Q6CR2.png" rel="noreferrer"><img src="https://i.stack.imgur.com/Q6CR2.png" alt="bitbucket user menu"></a>

Then the command that you should use is:

<pre><code>git clone https://username:generated_password@bitbucket.org/reponame/projectname.git
</code></pre>

blocks|key|123226|text|另一种选择是使用多阶段docker构建，以确保SSH密钥不包含在最终映像中。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|123227|如我的post中所述，您可以准备包含所需依赖项的中间映像以进行git克隆，然后将所需的文件COPY到最终映像中。|offset|length|style|CODE|123228|此外，如果我们LABEL我们的中间层，我们甚至可以在完成后从机器中删除它们。|123229|#+Choose+and+name+our+temporary+image.
FROM+alpine+as+intermediate
#+Add+metadata+identifying+these+images+as+our+build+containers+(this+will+be+useful+later!)
LABEL+stage=intermediate

#+Take+an+SSH+key+as+a+build+argument.
ARG+SSH_KEY

#+Install+dependencies+required+to+git+clone.
RUN+apk+update+&&+\
++++apk+add+--update+git+&&+\
++++apk+add+--update+openssh

#+1.+Create+the+SSH+directory.
#+2.+Populate+the+private+key+file.
#+3.+Set+the+required+permissions.
#+4.+Add+github+to+our+list+of+known+hosts+for+ssh.
RUN+mkdir+-p+/root/.ssh/+&&+\
++++echo+"$SSH_KEY"+>+/root/.ssh/id_rsa+&&+\
++++chmod+-R+600+/root/.ssh/+&&+\
++++ssh-keyscan+-t+rsa+github.com+>>+~/.ssh/known_hosts

#+Clone+a+repository+(my+website+in+this+case)
RUN+git+clone+git@github.com:janakerman/janakerman.git

#+Choose+the+base+image+for+our+final+image
FROM+alpine

#+Copy+across+the+files+from+our+`intermediate`+container
RUN+mkdir+files
COPY+--from=intermediate+/janakerman/README.md+/files/README.md|code-block|syntax|javascript|123230|然后我们可以构建：|123231|MY_KEY=$(cat+~/.ssh/id_rsa)
docker+build+--build-arg+SSH_KEY="$MY_KEY"+--tag+clone-example+.|123232|证明我们的SSH密钥已经消失：|123233|docker+run+-ti+--rm+clone-example+cat+/root/.ssh/id_rsa|123234|从构建机器中清除中间镜像：|123235|docker+rmi+-f+$(docker+images+-q+--filter+label=stage=intermediate)|123236|entityMap|0|LINK|mutability|MUTABLE|url|https://janakerman.co.uk/docker-git-clone/^0|0|19|4|3|4|0|0|7|5|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|18|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|19|8|@$D|1A|E|1B|F|G]]|9|@$D|1C|E|1D|1|1E]]|A|$]]|$1|H|3|I|5|6|7|1F|8|@$D|1G|E|1H|F|G]]|9|@]|A|$]]|$1|J|3|K|5|L|7|1I|8|@]|9|@]|A|$M|N]]|$1|O|3|P|5|6|7|1J|8|@]|9|@]|A|$]]|$1|Q|3|R|5|L|7|1K|8|@]|9|@]|A|$M|N]]|$1|S|3|T|5|6|7|1L|8|@]|9|@]|A|$]]|$1|U|3|V|5|L|7|1M|8|@]|9|@]|A|$M|N]]|$1|W|3|X|5|6|7|1N|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|L|7|1O|8|@]|9|@]|A|$M|N]]|$1|10|3|-4|5|6|7|1P|8|@]|9|@]|A|$]]]|11|$12|$5|13|14|15|A|$16|17]]]]

Another option is to use a multi-stage docker build to ensure that your SSH keys are not included in the final image.

As described in my <a href="https://janakerman.co.uk/docker-git-clone/" rel="noreferrer">post</a> you can prepare your intermediate image with the required dependencies to git clone and then <code>COPY</code> the required files into your final image.

Additionally if we <code>LABEL</code> our intermediate layers, we can even delete them from the machine when finished.

<pre><code># Choose and name our temporary image.
FROM alpine as intermediate
# Add metadata identifying these images as our build containers (this will be useful later!)
LABEL stage=intermediate

# Take an SSH key as a build argument.
ARG SSH_KEY

# Install dependencies required to git clone.
RUN apk update &amp;&amp; \
 apk add --update git &amp;&amp; \
 apk add --update openssh

# 1. Create the SSH directory.
# 2. Populate the private key file.
# 3. Set the required permissions.
# 4. Add github to our list of known hosts for ssh.
RUN mkdir -p /root/.ssh/ &amp;&amp; \
 echo "$SSH_KEY" &gt; /root/.ssh/id_rsa &amp;&amp; \
 chmod -R 600 /root/.ssh/ &amp;&amp; \
 ssh-keyscan -t rsa github.com &gt;&gt; ~/.ssh/known_hosts

# Clone a repository (my website in this case)
RUN git clone git@github.com:janakerman/janakerman.git

# Choose the base image for our final image
FROM alpine

# Copy across the files from our `intermediate` container
RUN mkdir files
COPY --from=intermediate /janakerman/README.md /files/README.md
</code></pre>

We can then build:

<pre><code>MY_KEY=$(cat ~/.ssh/id_rsa)
docker build --build-arg SSH_KEY="$MY_KEY" --tag clone-example .
</code></pre>

Prove our SSH keys are gone:

<pre><code>docker run -ti --rm clone-example cat /root/.ssh/id_rsa
</code></pre>

Clean intermediate images from the build machine:

<pre><code>docker rmi -f $(docker images -q --filter label=stage=intermediate)
</code></pre>

blocks|key|4629317|text|对于其他人搜索，我有相同的问题，添加--ssh+default标志使其工作|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4629318|entityMap^0|I|D|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

For other people searching I had the same issue adding <code>--ssh default</code> flag made it work

blocks|key|4629349|text|附注：这个解决方案是快速和简单的；但以降低安全性为代价(请参阅@jrh的评论)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4629350|4629351|创建访问令牌：https://github.com/settings/tokens|offset|length|4629352|将其作为参数传递给docker+(p.s.如果您使用的是CapRover，请在App+Configs下设置)|style|CODE|4629353|在Dockerfile中：|4629354|ARG+GITHUB_TOKEN=${GITHUB_TOKEN}
RUN+git+config+--global+url."https://${GITHUB_TOKEN}@github.com/".insteadOf+"https://github.com/"
RUN+pip+install+-r+requirements.txt|code-block|syntax|javascript|4629355|附注：这里假设私有存储库在requirements.txt中的格式如下|4629356|git%2Bhttps://github.com/<YOUR-USERNAME>/<YOUR-REPO>.git|4629357|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/settings/tokens^0|0|0|7|Y|0|0|S|8|13|B|0|0|0|D|G|0|0^^$0|@$1|2|3|4|5|6|7|13|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|14|8|@]|9|@]|A|$]]|$1|C|3|D|5|6|7|15|8|@]|9|@$E|16|F|17|1|18]]|A|$]]|$1|G|3|H|5|6|7|19|8|@$E|1A|F|1B|I|J]|$E|1C|F|1D|I|J]]|9|@]|A|$]]|$1|K|3|L|5|6|7|1E|8|@]|9|@]|A|$]]|$1|M|3|N|5|O|7|1F|8|@]|9|@]|A|$P|Q]]|$1|R|3|S|5|6|7|1G|8|@$E|1H|F|1I|I|J]]|9|@]|A|$]]|$1|T|3|U|5|O|7|1J|8|@]|9|@]|A|$P|Q]]|$1|V|3|-4|5|6|7|1K|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12]]]]

p.s. this solution is quick &amp; easy; but at a cost of reduced security (see comments by @jrh).
<hr />
Create an access token: <a href="https://github.com/settings/tokens" rel="nofollow noreferrer">https://github.com/settings/tokens</a>
pass it in as an argument to docker
(p.s. if you are using <code>CapRover</code>, set it under <code>App Configs</code>)
In your Dockerfile:
<pre><code>ARG GITHUB_TOKEN=${GITHUB_TOKEN}
RUN git config --global url.&quot;https://${GITHUB_TOKEN}@github.com/&quot;.insteadOf &quot;https://github.com/&quot;
RUN pip install -r requirements.txt
</code></pre>
p.s. this assumes that private repos are in the following format in <code>requirements.txt</code>:
<pre><code>git+https://github.com/&lt;YOUR-USERNAME&gt;/&lt;YOUR-REPO&gt;.git
</code></pre>

blocks|key|4629376|text|除了@Calvin+Froedge使用个人接入令牌(PAT)方法之外，|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4629377|您可能需要在PAT前添加oauth或oauth2作为用户名，才能像这样进行身份验证：|4629378|https://oauth:<token>@git-url.com/user/repo.git|code-block|syntax|javascript|4629379|entityMap^0|2|F|0|C|5|I|6|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|R|8|@$9|S|A|T|B|C]|$9|U|A|V|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|W|8|@]|D|@]|E|$K|L]]|$1|M|3|-4|5|6|7|X|8|@]|D|@]|E|$]]]|N|$]]

In addition to <code>@Calvin Froedge</code>'s approach to use Personal Access Token (PAT),
You may need to add <code>oauth</code> or <code>oauth2</code> as username before your PAT to authenticate like this:
<pre><code>https://oauth:&lt;token&gt;@git-url.com/user/repo.git
</code></pre>

I have copied this code from what seems to be various working dockerfiles around, here is mine:

<pre><code>FROM ubuntu

MAINTAINER Luke Crooks "luke@pumalo.org"

# Update aptitude with new repo
RUN apt-get update

# Install software 
RUN apt-get install -y git python-virtualenv

# Make ssh dir
RUN mkdir /root/.ssh/

# Copy over private key, and set permissions
ADD id_rsa /root/.ssh/id_rsa
RUN chmod 700 /root/.ssh/id_rsa
RUN chown -R root:root /root/.ssh

# Create known_hosts
RUN touch /root/.ssh/known_hosts

# Remove host checking
RUN echo "Host bitbucket.org\n\tStrictHostKeyChecking no\n" &gt;&gt; /root/.ssh/config

# Clone the conf files into the docker container
RUN git clone git@bitbucket.org:Pumalo/docker-conf.git /home/docker-conf
</code></pre>

This gives me the error

<pre><code>Step 10 : RUN git clone git@bitbucket.org:Pumalo/docker-conf.git /home/docker-conf
 ---&gt; Running in 0d244d812a54
Cloning into '/home/docker-conf'...
Warning: Permanently added 'bitbucket.org,131.103.20.167' (RSA) to the list of known hosts.
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
2014/04/30 16:07:28 The command [/bin/sh -c git clone git@bitbucket.org:Pumalo/docker-conf.git /home/docker-conf] returned a non-zero code: 128
</code></pre>

This is my first time using dockerfiles, but from what I have read (and taken from working configs) I cannot see why this doesn't work.

My id_rsa is in the same folder as my dockerfile and is a copy of my local key which can clone this repo no problem.

Edit: 

In my dockerfile I can add:

<pre><code>RUN cat /root/.ssh/id_rsa
</code></pre>

And it prints out the correct key, so I know its being copied correctly.

I have also tried to do as noah advised and ran:

<pre><code>RUN echo "Host bitbucket.org\n\tIdentityFile /root/.ssh/id_rsa\n\tStrictHostKeyChecking no" &gt;&gt; /etc/ssh/ssh_config
</code></pre>

This sadly also doesn't work.

Clone private git repo with dockerfile

身份验证

访问管理

Bitbucket

Docker

我从各种各样的dockerfile文件中复制了这段代码，下面是我的：FROM ubuntuMAINTAINER Luke Crooks "luke@pumalo.org"# Update aptitude with new repoRUN apt-get update# Install software RUN apt...

问使用dockerfile克隆私有git存储库
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用dockerfile克隆私有git存储库EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用dockerfile克隆私有git存储库
EN