SSH interface

The SSH interface provides access to the host system’s SSH agent from inside the workshop, allowing it to authenticate with the identities the agent holds. The private keys stay with the agent on the host, and the host’s SSH configuration files aren’t shared with the workshop.

By using the interface, the SDK publisher allows the workshop to connect to the host’s SSH agent, which can be useful in various SDK-specific tasks such as cloning private repositories, accessing remote machines, and so on.

SSH interface plug

An essential element here is the SSH interface plug, which is declared in the SDK definition.

Its structure includes just the name of the plug and the interface; both must be set to ssh-agent.

Defining the plug in an SDK allows the workshops using this SDK to connect to the host’s SSH agent, which can be useful in various SDK-specific tasks such as cloning private repositories, accessing remote machines, and so on.

SSH interface slot

To let SDKs in a workshop access the host’s SSH agent, Workshop provides an SSH interface slot that multiple SSH interface plugs can access.

When the SDK is installed at runtime during launch and refresh operations, Workshop checks that the plug targeting the slot passes validation; if it does, it can be connected.

Connection

The interface isn’t connected automatically at launch and refresh for security reasons. The workshop connect and workshop disconnect commands can be invoked manually after the workshop has started:

$ workshop connect ws/ssh-sdk:ssh-agent
$ workshop disconnect ws/ssh-sdk:ssh-agent

Establishing a connection means a proxy Unix domain socket has been created and a corresponding $SSH_AUTH_SOCK value has been set for the workshop user, so the identities held by the host’s SSH agent are available inside the workshop.

To check if the interface is connected:

$ workshop connections --all

  INTERFACE  PLUG                  SLOT                 NOTES
  ...
  ssh-agent  ws/ssh-sdk:ssh-agent  ws/system:ssh-agent  manual

This means the host’s SSH identities are available inside the workshop:

$ workshop shell ws
workshop@ws:/project$ echo $SSH_AUTH_SOCK

  /var/lib/workshop/run/ssh-agent.sock

workshop@ws:/project$ ssh-add -l

  4096 SHA256:cb19/bE/6irqhII1KbQqRmo1royWi58qcUD9MEn/9fE user@example.com (RSA)

While the interface is connected, any process in the workshop can ask the host’s SSH agent to authenticate with these identities, not just the SDK that declares the plug. Disconnect the interface when you don’t need it, especially before an autonomous coding agent starts working in the workshop.

See also

Explanation:

Reference: