Skip to content

Commit f2ded2f

Browse files
rgrunbervitaliy-guliy
rgrunber
and
vitaliy-guliy
committed
Support VS Code (local) to Devworkspace over SSH (che-incubator#560)
* Add SSH Support Signed-off-by: vitaliy-guliy <vgulyy@redhat.com> * More changes to support VS Code (local) to Devworkspace over SSH. - Custom image based on UDI that contains the non-root SSH daemon, basic web server to show webpage on startup to guide the user - che-code-sshd.yaml file as entrypoint to configure the custom image Signed-off-by: Roland Grunberg <rgrunber@redhat.com> * Add che-code-sshd image to publishing workflow - restore the disabled workflows. - editor definition to be re-located into che-operator Signed-off-by: Roland Grunberg <rgrunber@redhat.com> --------- Signed-off-by: vitaliy-guliy <vgulyy@redhat.com> Signed-off-by: Roland Grunberg <rgrunber@redhat.com> Co-authored-by: Vitaliy Gulyy <vgulyy@redhat.com>
1 parent 4df1d27 commit f2ded2f

4 files changed

Lines changed: 157 additions & 0 deletions

File tree

‎.github/workflows/image-publish.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,4 +198,5 @@ jobs:
198198
run: |
199199
SHORT_SHA1=$(git rev-parse --short=7 HEAD)
200200
docker buildx build --platform linux/amd64 -f build/dockerfiles/dev.Dockerfile --push -t quay.io/che-incubator/che-code-dev:insiders -t quay.io/che-incubator/che-code-dev:next -t quay.io/che-incubator/che-code-dev:insiders-${SHORT_SHA1} .
201+
docker buildx build --platform linux/amd64 -f build/dockerfiles/dev.sshd.Dockerfile --push -t quay.io/che-incubator/che-code-sshd:insiders -t quay.io/che-incubator/che-code-sshd:next -t quay.io/che-incubator/che-code-sshd:insiders-${SHORT_SHA1} .
201202

‎build/dockerfiles/dev.sshd.Dockerfile‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Copyright (c) 2025 Red Hat, Inc.
2+
# This program and the accompanying materials are made
3+
# available under the terms of the Eclipse Public License 2.0
4+
# which is available at https://www.eclipse.org/legal/epl-2.0/
5+
#
6+
# SPDX-License-Identifier: EPL-2.0
7+
#
8+
9+
FROM quay.io/devfile/universal-developer-image:latest
10+
11+
USER 0
12+
13+
RUN dnf -y install libsecret openssh-server && \
14+
dnf -y clean all --enablerepo='*'
15+
16+
# Step 1. Generate SSH Host keys
17+
RUN mkdir /opt/ssh
18+
RUN chmod 755 /opt/ssh
19+
RUN chown -R root:root /opt/ssh/
20+
21+
RUN ssh-keygen -q -N "" -t dsa -f /opt/ssh/ssh_host_dsa_key && \
22+
ssh-keygen -q -N "" -t rsa -b 4096 -f /opt/ssh/ssh_host_rsa_key && \
23+
ssh-keygen -q -N "" -t ecdsa -f /opt/ssh/ssh_host_ecdsa_key && \
24+
ssh-keygen -q -N "" -t ed25519 -f /opt/ssh/ssh_host_ed25519_key
25+
26+
# Step 2. Configure SSH as non-root user
27+
RUN cp /etc/ssh/sshd_config /opt/ssh/
28+
29+
# Step 3. Fix permissions
30+
RUN chmod 644 /opt/ssh/ssh_host_* /opt/ssh/sshd_config
31+
32+
# Use non-privileged port, set user authorized keys, disable strict checks
33+
RUN sed -i \
34+
-e 's|#Port 22|Port 2022|' \
35+
-e 's|AuthorizedKeysFile .ssh/authorized_keys|AuthorizedKeysFile /home/user/ssh/authorized_keys|' \
36+
-e 's|#StrictModes yes|StrictModes=no|' \
37+
-e 's|#PidFile /var/run/sshd.pid|PidFile /tmp/sshd.pid|' \
38+
-e 's|#LogLevel INFO|LogLevel DEBUG3|' \
39+
/opt/ssh/sshd_config
40+
41+
# Provide new path containing host keys
42+
RUN sed -i \
43+
-e 's|#HostKey /etc/ssh/ssh_host_rsa_key|HostKey /opt/ssh/ssh_host_rsa_key|' \
44+
-e 's|#HostKey /etc/ssh/ssh_host_ecdsa_key|HostKey /opt/ssh/ssh_host_ecdsa_key|' \
45+
-e 's|#HostKey /etc/ssh/ssh_host_ed25519_key|HostKey /opt/ssh/ssh_host_ed25519_key|' \
46+
/opt/ssh/sshd_config
47+
48+
# Prepare SSH Keys
49+
RUN ssh-keygen -q -N "" -t ed25519 -f /opt/ssh/ssh_client_ed25519_key
50+
RUN chmod 644 /opt/ssh/ssh_client_*
51+
52+
# Add script to start and stop the service
53+
COPY --chown=0:0 /build/scripts/sshd.start /
54+
55+
RUN mkdir /opt/www
56+
COPY /build/scripts/server.js /opt/www/
57+
58+
ENV USER_NAME=dev
59+
60+
EXPOSE 2022 3400
61+
62+
USER 10001

‎build/scripts/server.js‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
/*
2+
Copyright (c) 2025 Red Hat, Inc.
3+
This program and the accompanying materials are made
4+
available under the terms of the Eclipse Public License 2.0
5+
which is available at https://www.eclipse.org/legal/epl-2.0/
6+
7+
SPDX-License-Identifier: EPL-2.0
8+
*/
9+
10+
const http = require('http');
11+
const fs = require('fs');
12+
const hostname = '127.0.0.1';
13+
const port = 3400;
14+
15+
const server = http.createServer((req, res) => {
16+
res.statusCode = 200;
17+
res.setHeader('Content-Type', 'text/html');
18+
19+
let hasUserPrefSSHKey = fs.existsSync('/etc/ssh/dwo_ssh_key.pub');
20+
21+
let pubKey = "PUBLIC KEY COULD NOT BE DISPLAYED";
22+
try {
23+
pubKey = fs.readFileSync('/etc/ssh/dwo_ssh_key.pub', 'utf8');
24+
} catch (err) {
25+
// continue
26+
}
27+
28+
let genKey = "PRIVATE KEY NOT FOUND";
29+
try {
30+
genKey = fs.readFileSync('/opt/ssh/ssh_client_ed25519_key', 'utf8');
31+
} catch (err) {
32+
// continue
33+
}
34+
35+
let keyMessage = `
36+
<pre>${hasUserPrefSSHKey ? pubKey : genKey}</pre>
37+
</p>
38+
<p>
39+
This can also be configured locally in <code>$HOME/.ssh/config</code> with the following :`;
40+
41+
res.end(`
42+
<!DOCTYPE html>
43+
<html>
44+
<head>
45+
<title>${process.env["DEVWORKSPACE_NAME"]}</title>
46+
</head>
47+
<body>
48+
<h1>Workspace ${process.env["DEVWORKSPACE_NAME"]} is running</h1>
49+
<div class="border">
50+
<ol>
51+
<li>Make sure your local oc client is logged in to your OpenShift cluster</li>
52+
<li><p class="center">Run <code>oc port-forward ${process.env["HOSTNAME"]} 2022:2022</code>. This establishes a connection to the workspace.</p></li>
53+
<li>
54+
<p>In your local VS Code, connect to <code>localhost</code> on port <code>2022</code> with user <code>${process.env["USER_NAME"]}</code> ${hasUserPrefSSHKey ? `. The SSH key, corresponding to the following public key, configured in the "SSH Keys" tab of "User Preferences" has been authorized to connect :` : `and the following identity file :`} ${keyMessage}
55+
<pre>
56+
Host localhost
57+
HostName 127.0.0.1
58+
User ${process.env["USER_NAME"]}
59+
Port 2022
60+
IdentityFile /path/to/the/ssh_client_ed25519_key
61+
</pre>
62+
</p>
63+
</li>
64+
</ol>
65+
<p>If the connection fails with "<code>WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED</code>", it may be necessary to remove the <code>localhost</code> or <code>127.0.0.1</code> entries from <code>$HOME/.ssh/known_hosts</code>. This is because the SSHD service container (to which <code>oc port-forward</code> is forwarding) may change.</p>
66+
</div>
67+
</body>
68+
</html>
69+
`);
70+
});
71+
72+
server.listen(port, hostname, () => {
73+
console.log(`Server running at http://${hostname}:${port}/`);
74+
});

‎build/scripts/sshd.start‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
#
3+
# Copyright (c) 2025 Red Hat, Inc.
4+
# This program and the accompanying materials are made
5+
# available under the terms of the Eclipse Public License 2.0
6+
# which is available at https://www.eclipse.org/legal/epl-2.0/
7+
#
8+
# SPDX-License-Identifier: EPL-2.0
9+
#
10+
11+
rm -rf /home/user/ssh
12+
mkdir -p /home/user/ssh
13+
if [ -f /etc/ssh/dwo_ssh_key.pub ]; then
14+
cp /etc/ssh/dwo_ssh_key.pub /home/user/ssh/authorized_keys
15+
else
16+
cp /opt/ssh/ssh_client_ed25519_key.pub /home/user/ssh/authorized_keys
17+
fi
18+
19+
# start
20+
/usr/sbin/sshd -D -f /opt/ssh/sshd_config -E /tmp/sshd.log

0 commit comments

Comments
 (0)