fix: copy SSH keys off bind mounts on all platforms - #495
Merged
Conversation
Docker Desktop Mac presents ~/.lando/keys as root, so load-keys.sh skips them with -user www-data. Copy off the mount and chown like Windows.
✅ Deploy Preview for lando-core ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Drop the www-data find filter. If chown/chmod on the mount still leaves the key unreadable, copy just that file to /lando_keys.
AaronFeledy
changed the title
Use /lando_keys everywhere, same as Windows. Docker bind mounts cannot be chowned reliably, so IdentityFile always points at the in-container copy.
AaronFeledy
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6c8818d. Configure here.
Stale copies survived restarts and stayed in ssh_config after host keys were removed or deselected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Problem This Solves
Docker bind-mounted SSH keys often show up as root-owned (especially Docker Desktop Mac with virtiofs).
load-keys.shthen either cannot chmod them or skips them, so git/SSH inside the container has no IdentityFile.Why This Change Was Made
Windows already copied keys to
/lando_keysbecause bind mounts cannot be chmod'd. That is the correct model on every OS: copy off the mount, chown the copy, never SSH with the live bind mount.User Impact
Mac
lando init --source pantheonand other SSH-using commands can use the Lando key without switching Docker file sharing. Linux/Windows behavior matches: keys are copied, then loaded.Evidence
/lando_keysfor this reason/lando_keys/Note
Medium Risk
Changes core container SSH key loading for every OS; mis-copy or permission bugs would break git/SSH in apps, but scope is limited to
load-keys.sh.Overview
SSH keys are always staged in
/lando_keysbefore use, extending the Windows-only workaround to every host OS so bind-mounted keys (often root-owned on Docker Desktop Mac) can bechown/chmodand registered asIdentityFileinssh_config.load-keys.shnow wipes and repopulates/lando_keysfrom/lando/keys,/var/www/.ssh, and optionally/user/.ssh, then scans only that directory. Key discovery no longer filters by-user $LANDO_WEBROOT_USER, and explicitLANDO_LOAD_KEYSnames are copied from/user/.sshinto/lando_keysinstead of referencing the mount directly. The keys example README and CHANGELOG document the new paths.Reviewed by Cursor Bugbot for commit 7177701. Bugbot is set up for automated code reviews on this repo. Configure here.