Docker：在 Buildkit 中使用 SSH

Question

在documentation 之后，我正在尝试将 SSH 密钥传递给我的容器。这是我原来的 Dockerfile

# syntax=docker/dockerfile:experimental
FROM tiangolo/uvicorn-gunicorn-fastapi:python3.6

RUN mkdir -p -m 0600 ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts

RUN --mount=type=ssh git clone git@github.com:USER/REPO.git

这行得通

DOCKER_BUILDKIT=1 docker build --ssh default=~/github .

但是，如果我尝试使用 apt 安装任何东西：

# syntax=docker/dockerfile:experimental
FROM tiangolo/uvicorn-gunicorn-fastapi:python3.6

RUN apt update

RUN mkdir -p -m 0600 ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts

RUN --mount=type=ssh git clone git@github.com:USER/REPO.git

我收到以下错误：

[+] Building 1.8s (7/9)
 => [internal] load .dockerignore                                                                                                                                                                                                       0.0s
 => => transferring context: 2B                                                                                                                                                                                                         0.0s
 => [internal] load build definition from Dockerfile                                                                                                                                                                                    0.0s
 => => transferring dockerfile: 306B                                                                                                                                                                                                    0.0s
 => resolve image config for docker.io/docker/dockerfile:experimental                                                                                                                                                                   1.1s
 => CACHED docker-image://docker.io/docker/dockerfile:experimental@sha256:de85b2f3a3e8a2f7fe48e8e84a65f6fdd5cd5183afa6412fff9caa6871649c44                                                                                              0.0s
 => [internal] load metadata for docker.io/tiangolo/uvicorn-gunicorn-fastapi:python3.6                                                                                                                                                  0.0s
 => CACHED [1/4] FROM docker.io/tiangolo/uvicorn-gunicorn-fastapi:python3.6                                                                                                                                                             0.0s
 => ERROR [2/4] RUN apt update                                                                                                                                                                                                          0.4s
------
 > [2/4] RUN apt update:
#7 0.352
#7 0.352 WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
#7 0.352
#7 0.359 Reading package lists...
#7 0.375 E: Could not get lock /var/lib/apt/lists/lock - open (13: Permission denied)
#7 0.375 E: Unable to lock directory /var/lib/apt/lists/
------
failed to solve with frontend dockerfile.v0: failed to solve with frontend gateway.v0: rpc error: code = Unknown desc = failed to build LLB: executor failed running [/bin/sh -c apt update]: runc did not terminate sucessfully

但是，如果禁用了 Buildkit，第二个 Dockerfile 确实可以工作。关于可能是什么问题的任何建议？

Answer 1

我遇到了同样的问题。对我来说，解决方案是升级 Docker。我在19.03.11 上遇到了这个问题，我的 Ubuntu 安装很快就出现了。 20.10.1（截至本文最新）为我工作。

更多信息在这里：https://github.com/moby/moby/issues/39106#issuecomment-752246367

编辑：不幸的是，当build 以非交互方式运行（例如，作为基于 systemd 的 CI 代理）时，这不起作用 - 至少对我而言。