Cannot pull the code from repository to docker images when build.

[Chatree Kunjai]

Hi, I got the error when pulling the code from the private repository to the docker images.

On below is an errors.

#5 [10/10] RUN git clone --branch hotfix/some-hotfix git@bitbucket.org:workspaces-name/somerepo.git /basedir
#5 sha256:b815577ee879a9bc344d6239d834cc524f4a78f2f1c6949a2e14f2776a595c14
#5 0.291 Cloning into '/basedir'...
#5 0.319 Warning: Permanently added the ECDSA host key for IP address '18.205.93.2' to the list of known hosts.
#5 0.518 Permission denied (publickey).
#5 0.518 fatal: Could not read from remote repository.
#5 0.518
#5 0.518 Please make sure you have the correct access rights
#5 0.518 and the repository exists.
#5 ERROR: process "/bin/sh -c git clone --branch $BITBUCKET_BRANCH git@bitbucket.org:workspaces-name/somerepo.git /basedir" did not complete successfully: exit code: 128

The dockerfile.

FROM docker-image:base

# Add Maintainer Info
LABEL maintainer="somebody"

# Add Argument for build
ARG ssh_prv_key
ARG ssh_pub_key
ARG bitbucket_branch

RUN mkdir -p ~/.ssh && \
    chmod 0700 ~/.ssh

# Add the keys and set permissions
RUN echo "$ssh_prv_key" > ~/.ssh/id_rsa && \
    echo "$ssh_pub_key" > ~/.ssh/id_rsa.pub && \
    chmod 600 ~/.ssh/id_rsa && \
    chmod 600 ~/.ssh/id_rsa.pub

RUN touch ~/.ssh/known_hosts && \
    ssh-keygen -R bitbucket.org && sed -i.old -e '/AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/d' ~/.ssh/known_hosts && curl https://bitbucket.org/site/ssh >> ~/.ssh/known_hosts

# setup code
RUN git clone --branch $bitbucket_branch git@bitbucket.org:workspaces-name/somerepo.git /basedir

CMD ["/run.sh"]

The docker build command on pipeline. The variable $SSH_PRIVATE_KEY and $SSH_PUB_KEY was added on repository variables.

docker build --no-cache -t $IMAGE_NAME --build-arg "ssh_prv_key=$SSH_PRIVATE_KEY" --build-arg "ssh_pub_key=$SSH_PUB_KEY" --build-arg bitbucket_branch=$BITBUCKET_BRANCH -f ./Dockerfile .

I tried to recheck the public key on my local machine that was added to ACCESS_KEY in the repository setting. It seems working fine.

# ssh -F /dev/null -o IdentitiesOnly=yes -i id_ecdsa git@bitbucket.org
allocation request failed on channel 0
authenticated via ssh key.

You can use git to connect to Bitbucket. Shell access is disabled
Connection to bitbucket.org closed.

I already tested the docker images on my local machine and is build completed, but on the bitbucket cloud. It stuck at the error above.

Any suggestion?

[Theodora Boudale]

Hi Chatree,

Pipelines does not currently support line breaks in environment variables, and SSH key files contain line breaks. You will need to base-64 encode the private key on your computer, and then store in the variable $SSH_PRIVATE_KEY the base-64 encoded value.

Then, in the Dockerfile, you can decode the variable as follows:

RUN echo $ssh_prv_key | base64 --decode > ~/.ssh/id_rsa && \
    chmod 600 ~/.ssh/id_rsa

Similarly with the public key, although I don't think that you need the public key to be present in order to clone. Just the private key should be enough.

Could you give it a try and let me know how it goes?

You can also check the following page for info on how to encode the private key:

• https://support.atlassian.com/bitbucket-cloud/docs/use-multiple-ssh-keys-in-your-pipeline/

Just a heads up, in the command where you create the known_hosts file, you can remove the following part:

ssh-keygen -R bitbucket.org && sed -i.old -e '/AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/d' ~/.ssh/known_hosts

This is for removing entries with the old Bitbucket Cloud host key. If this is a brand new file, simply fetching the host keys with curl https://bitbucket.org/site/ssh >> ~/.ssh/known_hosts is enough. This is not related to the Permission denied error you see; it's just a suggestion for improvement.

Kind regards,
Theodora