From 4f5c6d4dbc2514f4053a85974dfb1fa3dbc321fb Mon Sep 17 00:00:00 2001 From: Naoyuki Sogo Date: Thu, 10 Sep 2026 19:41:27 +0900 Subject: [PATCH 1/3] fix(entrypoint): start ssh-agent without writing into the bind-mounted home The ssh-agent startup added in 1cf80702 writes an env-dump file to /root/ssh_env and appends `source /root/ssh_env` to /root/.bashrc on every container start. With compose.dev.yml / the documented `docker run` bind-mounting ${HOME}:/root, those land in the host user's ~/ssh_env and ~/.bashrc, the latter accumulating a line per start. (macOS defaults to zsh so it went unnoticed there, but it still pollutes ~/.bashrc.) Only the WHEEL server process needs the agent env, and it already gets it in the current code (the `source` before `npm start`). Replace the file + .bashrc write with an agent on a fixed, container-local socket: - entrypoint.sh: `ssh-agent -a /tmp/wheel-ssh-agent.sock`, export SSH_AUTH_SOCK, then `exec npm start` (also makes npm the container's PID 1). /tmp is not bind-mounted, so nothing is written to the host home. - Dockerfile: add one line to the image's /etc/bash.bashrc that exports SSH_AUTH_SOCK when that socket exists, so `docker exec ... bash` sessions still attach to the same agent - the only thing the /root/.bashrc write was for. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01C3jKNM1qubomM8UTRdkEWu --- Dockerfile | 5 +++++ entrypoint.sh | 16 +++++++++++----- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index ffc07bea..843b5d37 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,6 +12,11 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt -y install curl git rsy apt-get clean &&\ rm -rf /var/lib/apt/lists/* +# entrypoint.sh starts an ssh-agent on this fixed, container-local socket; let +# `docker exec ... bash` sessions attach to the same agent without writing to the +# bind-mounted home. No-op when the socket is absent. +RUN printf '\n[ -S /tmp/wheel-ssh-agent.sock ] && export SSH_AUTH_SOCK=/tmp/wheel-ssh-agent.sock\n' >> /etc/bash.bashrc + FROM base AS run_base WORKDIR /usr/src/ COPY package.json package.json diff --git a/entrypoint.sh b/entrypoint.sh index d5cdc6cc..593c77da 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -27,9 +27,15 @@ if [ "xYES" == "x${WHEEL_ANONYMOUS_LOGIN}" ]; then export WHEEL_ENABLE_AUTH=YES fi -SSH_ENV_FILE=/root/ssh_env -ssh-agent -s > ${SSH_ENV_FILE} -source ${SSH_ENV_FILE} -echo "source ${SSH_ENV_FILE}" >> /root/.bashrc +# start an ssh-agent for the WHEEL server. WHEEL spawns many `ssh` subprocesses +# (ssh-client-wrapper) that inherit SSH_AUTH_SOCK from this process, so with +# AddKeysToAgent in the user's ssh config the key passphrase is entered once (via +# the browser prompt) and reused, and agent forwarding works for ProxyJump chains. +# The socket lives on a container-local path (/tmp is not bind-mounted) so nothing +# is written into a bind-mounted home - a shared /etc/bash.bashrc line (see +# Dockerfile) lets `docker exec ... bash` pick up the same agent. +export SSH_AUTH_SOCK=/tmp/wheel-ssh-agent.sock +rm -f "${SSH_AUTH_SOCK}" +ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null -npm start +exec npm start From ad6809aea96eeb24c7974878eee48ec6f2a0bf78 Mon Sep 17 00:00:00 2001 From: "version-number-updater[bot]" Date: Thu, 10 Sep 2026 19:48:29 +0900 Subject: [PATCH 2/3] [skip ci] update version number --- server/app/db/version.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/app/db/version.json b/server/app/db/version.json index 128da255..6d01eda7 100644 --- a/server/app/db/version.json +++ b/server/app/db/version.json @@ -1 +1 @@ -{"version": "2026-0903-113554-beta" } \ No newline at end of file +{"version": "2026-0910-194829-beta" } \ No newline at end of file From cbf163aa959cfe5038c039a7415860f3bb5a1062 Mon Sep 17 00:00:00 2001 From: "version-number-updater[bot]" Date: Thu, 10 Sep 2026 20:46:42 +0900 Subject: [PATCH 3/3] [skip ci] update version number --- server/app/db/version.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/app/db/version.json b/server/app/db/version.json index 6d01eda7..2df01726 100644 --- a/server/app/db/version.json +++ b/server/app/db/version.json @@ -1 +1 @@ -{"version": "2026-0910-194829-beta" } \ No newline at end of file +{"version": "2026-0910-204642-beta" } \ No newline at end of file