Conversation
SSH mounts previously failed on Windows because the mount was set up as a UNIX-domain socket with chown/chmod and bind-mounted into the container, none of which work for WCOW. Windows OpenSSH instead talks to the named pipe \\.\pipe\openssh-ssh-agent and ignores SSH_AUTH_SOCK. Split MountSSHSocket and sshMountInstance.Mount into platform files. The Unix path is unchanged. The Windows path serves the forwarded agent over a winio named pipe (access controlled by a security descriptor instead of POSIX perms) and returns it as an 'npipe' mount. The executor forwards such mounts straight to HCS, preserving the pipe destination verbatim rather than mounting locally or rooting it to C:\, mirroring the existing tracing-socket forwarding. Named-pipe destinations are device paths, not filesystem paths, so they must not be cleaned or joined to the working directory. PrepareMounts previously ran the ssh target through filepath.Join (IsAbs rejects \\.\pipe\... as a UNC path), which collapsed the '.' segment and corrupted the destination to \\pipe\openssh-ssh-agent. A new system.IsNamedPipePath guards against this. On Windows the default ssh mount target becomes \\.\pipe\openssh-ssh-agent and SSH_AUTH_SOCK is not set; UID/GID/mode are unsupported and ignored. Adds unit and integration tests and documents the Windows behavior in the Dockerfile reference. The integration test compiles a small probe that connects to the agent pipe and completes an ssh-agent handshake, since nanoserver ships no ssh client and cmd cannot open a named pipe. Cover required and optional agents, exact key identity, custom IDs, read-only forwarding, and connection cleanup in Windows client and Dockerfile integration tests. Share an isolated named-pipe agent and probe between Windows suites while preserving existing Linux tests. Require exact SSH_AGENT_FAILURE frames for mutation rejection and cover incorrect response types, malformed frames, and transport failures. Signed-off-by: Dawei Wei <wei.dawei.cn@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4837.
Summary
Support SSH agent forwarding in Windows containers through named pipes,
defaulting to
\\.\pipe\openssh-ssh-agent. Map the worker pipe through HCS,preserve named-pipe paths, and apply Windows pipe access controls.
Document Windows-specific behavior:
SSH_AUTH_SOCKis not automaticallyset, and Unix socket ownership and permission options do not apply.
Unix SSH mount behavior remains unchanged.
Coverage
Add Windows-only client and Dockerfile tests for required/optional mounts,
agent IDs, key identity, agent and key-file providers, mutation rejection,
and connection cleanup. Existing Linux tests remain unchanged.
Both Windows suites share an isolated test agent and a Go protocol probe,
since Nano Server does not include an SSH client.