Support for macOS socket inside a container?

[luislavena]

Hello folks, been trying to do something that not sure if possible. I would like to expose 1Password SSH agent socket (agent.sock) that is present in my local installation to a container.

This works without issues on another setup were host is Linux and containers are Linux, but since OrbStack uses a VM to run the container, not sure the sockets can be shared the same way.

Right now when I try to share the directory that contains the socket and explicitly tell the container to use it, I'm always getting weird results:

on macOS:

$ file '/Users/luis/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock'
/Users/luis/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock: socket

$ SSH_AUTH_SOCK='/Users/luis/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock' ssh-add -l
256 SHA256:bJV6cU...  (ED25519)
2048 SHA256:5klb+onb... (RSA)
256 SHA256:SpZPhrd... (ED25519)

$ cd ~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t

$ docker run -it --rm -v .:/data alpine:latest sh -i

/ # cd /data/
/data # ls -lha
total 0
drwx------    4 root     root         128 Aug 30 08:38 .
drwxr-xr-x    1 root     root          16 Aug 30 14:37 ..
srw-------    1 root     root           0 Aug 30 08:38 agent.sock
srw-------    1 root     root           0 Aug 30 08:38 s.sock
/data # export SSH_AUTH_SOCK=/data/agent.sock

/data # apk add openssh-client
...
OK: 13 MiB in 21 packages

/data # ssh-add -l
Error connecting to agent: Connection refused

Has anyone experienced or tried this?

Thank you in advance.

[kdrag0n]

-v $SSH_AUTH_SOCK:/agent.sock works in most cases, but not with 1Password's agent. You have to use /run/host-services/ssh-auth.sock instead. Just updated the docs to cover this: https://docs.orbstack.dev/docker/#ssh-agent-forwarding

The general case of Unix socket forwarding isn't supported yet, because the VM layer makes it challenging as you mentioned. Subscribe to #62 for updates.

[luislavena]

Thank you @kdrag0n, I was not sure if the conversation in #62 was relevant to this case, as it doesn't explicitly talk of sharing a UNIX socket from macOS into containers the creation of a unix socket on the macOS filesystem.

That part (Linux socket on macOS filesystem) has worked for me for things like overmind socket without issues, so that is why I posted this here 😁

I will keep an eye on the other issue, thank you.

Cheers.

[kdrag0n]

Yes, it should work if both the client and server are on the same side, but sharing is problematic.