fix: lazydocker can't use DOCKER_HOST=ssh:// on Tailscale SSH - #831
Open
nicobonada wants to merge 1 commit into
Open
fix: lazydocker can't use DOCKER_HOST=ssh:// on Tailscale SSH#831nicobonada wants to merge 1 commit into
nicobonada wants to merge 1 commit into
Conversation
Replace streamlocal SSH forwarding of /var/run/docker.sock with the official docker/cli connhelper path (ssh … docker system dial-stdio). Matches the Docker CLI and works with restricted SSH servers such as Tailscale SSH that refuse unix socket forwards outside user directories.
nicobonada
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When connecting to a remote Docker daemon via
ssh://(DOCKER_HOSTor an SSH Docker context), lazydocker currently opens an SSH streamlocal tunnel to/var/run/docker.sockand rewrites the client to a local unix socket (pkg/commands/ssh).The Docker CLI instead uses
docker system dial-stdioover SSH (github.com/docker/cli/cli/connhelper). That path works in places the streamlocal tunnel does not—most notably Tailscale SSH, which refuses unix-socket forwards to/var/run/docker.sock(allowlist is home //tmp//run/user/<uid>only). Result today:docker psworks, lazydocker times out on the tunnel.This PR switches
ssh://client setup to the official connhelper (same approach as the CLI) and removes the custom tunnel package.Changes
newDockerClient: forssh://hosts, useconnhelper.GetConnectionHelper+client.WithDialContext(dial-stdio); leave unix/tcp hosts unchangedpkg/commands/ssh(streamlocal tunnel + tests that only covered that path)DOCKER_HOSTfor the resolved host when unset, so subprocessdocker/ compose invocations see the same target (includingssh://)Closers(replaces the old tunnel closer)No new dependencies:
docker/cli(and connhelper) were already vendored.Why not keep the tunnel
-L …:/var/run/docker.sock)dockeras the userssh:///var/run/docker.sockAligning with the CLI is the durable fix; special-casing Tailscale would not help other restricted SSH setups.
Testing
GOFLAGS=-mod=vendor go test ./pkg/commands/(and full package tests under the same flags as CI)DOCKER_HOST=ssh://user@host lazydockeragainst a host served by Tailscale SSH — containers list matchesdocker psDOCKER_HOSTunchangedRelated issues
(Also relevant background: #213, #228 — earlier SSH /
DOCKER_HOSTfriction.)Notes for reviewers
masterssh://; UI and API usage are unchanged