You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/doc/installation/with-docker.en-us.md
+41-62Lines changed: 41 additions & 62 deletions
Original file line number
Diff line number
Diff line change
@@ -291,7 +291,8 @@ files; for named volumes, this is done through another container or by direct ac
291
291
:exclamation::exclamation:**Make sure you have volumed data to somewhere outside Docker container**:exclamation::exclamation:
292
292
293
293
To upgrade your installation to the latest release:
294
-
```
294
+
295
+
```bash
295
296
# Edit `docker-compose.yml` to update the version, if you have one specified
296
297
# Pull new images
297
298
docker-compose pull
@@ -301,88 +302,66 @@ docker-compose up -d
301
302
302
303
# SSH Container Passthrough
303
304
304
-
Since SSH is running inside the container, you'll have to pass SSH from the host to the
305
-
container if you wish to use SSH support. If you wish to do this without running the container
306
-
SSH on a non-standard port (or move your host port to a non-standard port), you can forward
307
-
SSH connections destined for the container with a little extra setup.
305
+
Since SSH is running inside the container, SSH needs to be passed through from the host to the container if SSH support is desired. One option would be to run the container SSH on a non-standard port (or moving the host port to a non-standard port). Another option which might be more straightforward is to forward SSH connections from the host to the container. This setup is explained in the following.
308
306
309
-
This guide assumes that you have created a user on the host called `git` which shares the same
310
-
UID/GID as the container values `USER_UID`/`USER_GID`. You should also create the directory
311
-
`/var/lib/gitea` on the host, owned by the `git` user and mounted in the container, e.g.
307
+
This guide assumes that you have created a user on the host called `git` which shares the same `UID`/ `GID` as the container values `USER_UID`/ `USER_GID`. These values can be set as environment variables in the `docker-compose.yml`:
312
308
309
+
```bash
310
+
environment:
311
+
- USER_UID=1000
312
+
- USER_GID=1000
313
313
```
314
-
version: "3"
315
314
316
-
services:
317
-
server:
318
-
image: gitea/gitea:{{< version >}}
319
-
container_name: gitea
320
-
environment:
321
-
- USER_UID=1000
322
-
- USER_GID=1000
323
-
restart: always
324
-
networks:
325
-
- gitea
326
-
volumes:
327
-
- /var/lib/gitea:/data
328
-
- /etc/timezone:/etc/timezone:ro
329
-
- /etc/localtime:/etc/localtime:ro
330
-
ports:
331
-
- "3000:3000"
332
-
- "127.0.0.1:2222:22"
333
-
```
315
+
Next mount `/home/git/.ssh` of the host into the container. Otherwise the SSH authentication cannot work inside the container.
334
316
335
-
You can see that we're also exposing the container SSH port to port 2222 on the host, and binding this
336
-
to 127.0.0.1 to prevent it being accessible external to the host machine itself.
317
+
```bash
318
+
volumes:
319
+
- /home/git/.ssh/:/data/git/.ssh
320
+
```
337
321
338
-
On the **host**, you should create the file `/app/gitea/gitea` with the following contents and
339
-
make it executable (`chmod +x /app/gitea/gitea`):
322
+
Now a SSH key pair needs to be created on the host. This key pair will be used to authenticate the `git` user on the host to the container.
In the next step a file named `/app/gitea/gitea` (with executable permissions) needs to be created on the host. This file will issue the SSH forwarding from the host to the container. Add the following contents to `/app/gitea/gitea`:
Your `git` user needs to have an SSH key generated:
334
+
To make the forwarding work, the SSH port of the container (22) needs to be mapped to the host port 2222 in `docker-compose.yml` . Since this port does not need to be exposed to the outside world, it can be mapped to the `localhost` of the host machine:
- symlink the container `.ssh/authorized_keys` file to your git user `.ssh/authorized_keys`.
355
-
This can be done on the host as the `/var/lib/gitea` directory is mounted inside the container under `/data`:
342
+
In addition, `/home/git/.ssh/authorized_keys` on the host needs to be modified. It needs to act in the same way as `authorized_keys` within the Gitea container. Therefore add
In addition the public key of the `git` user on the host needs to be added to `/home/git/.ssh/authorized_keys` so authentication against the container can succeed: `echo "$(cat /home/git/.ssh/id_rsa.pub)" >> /home/git/.ssh/authorized_keys`.
366
351
367
-
Lastly, Gitea makes `authorized_keys` backups by default. This could be a problem
368
-
as the symbolic link made to `authorized_keys` previously could end up pointing
369
-
to an old backup. To resolve this, please put the following into your Gitea
370
-
config:
352
+
Here is a detailed explanation what is happening when a SSH request is made:
371
353
372
-
```
373
-
[ssh]
374
-
SSH_AUTHORIZED_KEYS_BACKUP=false
375
-
```
354
+
1. A SSH request is made against the host using the `git` user, e.g. `git clone git@domain:user/repo.git`.
355
+
2. In `/home/git/.ssh/authorized_keys` , the command executes the `/app/gitea/gitea` script.
356
+
3.`/app/gitea/gitea` forwards the SSH request to port 2222 which is mapped to the SSH port (22) of the container.
357
+
4. Due to the existence of the public key of the `git` user in `/home/git/.ssh/authorized_keys` the authentication host → container succeeds and the SSH request get forwarded to Gitea running in the docker container.
376
358
377
-
- mount your `.ssh` directory directly into the container i.e. add the
378
-
following to the `volumes` section of your Docker container config:
359
+
If a new SSH key is added in the Gitea web interface, it will be appended to `.ssh/authorized_keys` in the same way as the already existing key.
379
360
380
-
```
381
-
- /home/git/.ssh/:/data/git/.ssh/
382
-
```
361
+
**Notes**
383
362
384
-
Now you should be able to use Git over SSH to your container without disrupting SSH access to the host.
363
+
SSH container passthrough will work only if
385
364
386
-
Please note: SSH container passthrough will work only if using opensshd in container, and will not work if
387
-
`AuthorizedKeysCommand` is used in combination with setting `SSH_CREATE_AUTHORIZED_KEYS_FILE=false` to disable
388
-
authorized files key generation.
365
+
-`opensshd` is used in the container
366
+
- if `AuthorizedKeysCommand` is _not used_in combination with `SSH_CREATE_AUTHORIZED_KEYS_FILE=false` to disable authorized files key generation
0 commit comments