Please add openssh-keygen to Dockerfile-rootless #14214

New Issue

GiteaMirror · 2025-11-02T11:06:39-06:00

GiteaMirror commented

2025-11-02 11:06:39 -06:00

Originally created by @p7kdev on GitHub (Mar 4, 2025).

Feature Description

Hi,

I prefer the rootless container variant and use the built-in SSH server. This works perfectly so far. I only have the problem of the initial installation and the generation of the SSH host keys, because there is no tool in the rootless image to generate the keys. I am aware that an RSA key is created automatically. But the others (ecdsa, ed25519) are not.

I run this in K8s. At the moment I'm helping myself by having an initContainer (the rootfull variant), which then generates the keys with openssh-keygen. But that feels like overkill to define an extra image just for that instead of using the same rootless image. It would be much more convenient if the openssh-keygen tool was also available in the rootless container. It only adds a few KB, but really makes your life easier.

af2800d5c2df:/var/lib/gitea# apk add openssh-keygen -i
The following NEW packages will be installed:
  openssh-keygen
Need to download 202 KiB of packages.
After this operation, 470 KiB of additional disk space will be used.

The official helm chart uses the rootfull variant by default. There is also a flag to use the rootless variant. In this case, however, only the RSA key seems to be created and used. That feels incomplete.

Thanks already!

Best regards,
Paul

Screenshots

No response

Originally created by @p7kdev on GitHub (Mar 4, 2025). ### Feature Description Hi, I prefer the rootless container variant and use the built-in SSH server. This works perfectly so far. I only have the problem of the initial installation and the generation of the SSH host keys, because there is no tool in the rootless image to generate the keys. I am aware that an RSA key is created automatically. But the others (ecdsa, ed25519) are not. I run this in K8s. At the moment I'm helping myself by having an initContainer (the rootfull variant), which then generates the keys with openssh-keygen. But that feels like overkill to define an extra image just for that instead of using the same rootless image. It would be much more convenient if the `openssh-keygen` tool was also available in the rootless container. It only adds a few KB, but really makes your life easier. ```plain af2800d5c2df:/var/lib/gitea# apk add openssh-keygen -i The following NEW packages will be installed: openssh-keygen Need to download 202 KiB of packages. After this operation, 470 KiB of additional disk space will be used. ``` The official helm chart uses the rootfull variant by default. There is also a flag to use the rootless variant. In this case, however, only the RSA key seems to be created and used. That feels incomplete. Thanks already! Best regards, Paul ### Screenshots _No response_

GiteaMirror added the type/proposal topic/build labels 2025-11-02 11:06:39 -06:00

GiteaMirror closed this issue

2025-11-02 11:06:39 -06:00

GiteaMirror commented

2025-11-02 11:06:40 -06:00

@TheFox0x7 commented on GitHub (Mar 22, 2025):

Would parity of generating rsa, ecdsa and ed25519 keys be enough, or do you want openssh-keygen to be included as well?

@TheFox0x7 commented on GitHub (Mar 22, 2025): Would parity of generating rsa, ecdsa and ed25519 keys be enough, or do you want openssh-keygen to be included as well?

GiteaMirror commented

2025-11-02 11:06:40 -06:00

@p7kdev commented on GitHub (Mar 23, 2025):

Thank you very much!

If all keys could be created automatically, this would certainly be welcome and would provide a better out of the box experience for all (rootless) users. It would also reflect the same behavior that the rootfull container has (openssh also generates all keys automatically, if not already present)!

However, it would be useful to have the option of creating keys yourself. Simply to generate new keys or to define the properties of the keys (e.g. the keysize of the RSA key). openssh-keygen was just the most obvious solution. But if gitea itself has the ability to create keys, we could also extend the CLI so that we can do that with it. There is already a generate command that can create secrets. It would be logical to use it to create SSH keys as well. Or alternatively a gitea genkey command. That would of course be much better than being dependent on openssh-keygen.

gitea generate --help
NAME:
   gitea generate - Generate Gitea's secrets/keys/tokens

USAGE:
   gitea generate command [command options]

COMMANDS:
   secret   Generate a secret token
   help, h  Shows a list of commands or help for one command

@p7kdev commented on GitHub (Mar 23, 2025): Thank you very much! If all keys could be created automatically, this would certainly be welcome and would provide a better out of the box experience for all (rootless) users. It would also reflect the same behavior that the rootfull container has (openssh also generates all keys automatically, if not already present)! However, it would be useful to have the option of creating keys yourself. Simply to generate new keys or to define the properties of the keys (e.g. the keysize of the RSA key). openssh-keygen was just the most obvious solution. But if gitea itself has the ability to create keys, we could also extend the CLI so that we can do that with it. There is already a generate command that can create secrets. It would be logical to use it to create SSH keys as well. Or alternatively a `gitea genkey` command. That would of course be much better than being dependent on openssh-keygen. ``` gitea generate --help NAME: gitea generate - Generate Gitea's secrets/keys/tokens USAGE: gitea generate command [command options] COMMANDS: secret Generate a secret token help, h Shows a list of commands or help for one command ```

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14214