bthlabs/docker-bastion repository overview

⁠BTHLabs Docker Bastion

Simple bastion in a Docker image, powered by SSH.

Your RDS instance isn't accessible on the Internet but you really need to fix something in the DB? No worries, just run a bastion pod on your EKS cluster and you'll be hacking in a minute. Don't try this at work ;).

This image allows you to set up an arbitrary SSH tunnel and to connect to it. Use it to access services running inside your k8s cluster, cloud services not exposed on the Internet or anything else.

⁠Usage

⁠Starting up

$ docker run --rm -p 12345:22 bthlabs/docker-bastion:20240723.01

⁠Setting up a tunnel

$ ssh -N -o StrictHostKeyChecking=no -L 15432:postgres.databases.svc.cluster.local:5432 -p 12345 [email protected]

-N is required, since the bastion user is set up with /bin/false as login shell. -o StrictHostKeyChecking=no is required if you choose not to override built-in host keys. More on that below.

⁠Handling keys

Authorized keys

By default, the bastion user doesn't have any authorized keys. Since password authentication is disabled on the server, you won't be able to log in. You'll either need to mount your own authorized_keys file as volume or inherit the image and COPY it. The default path is /srv/bastion/.ssh/authorized_keys.

As packaged, the server is set to ignore the authorized_keys file's permissions. This is a deliberate choice, to simplify use when the file is mounted. If you wish to enforce strict modes, you can do so by setting USE_STRICT_MODES env var.

Host keys

By default, host keys are regenerated each time the image is ran. This is a deliberate choice, so the keys aren't all over the Internet. If you wish to customize the keys, inherit the image and COPY them.

As packaged, the server is set to look for host keys in /srv/ssh. The expected filenames are: ssh_host_dsa_key, ssh_host_rsa_key, ssh_host_ecdsa_key and ssh_host_ed25519_key.

If you provide your own keys, remember to set USE_OWN_HOST_KEYS env var so they don't get overwritten during startup.

⁠Configuration

⁠Environment variables

• USE_STRICT_MODES - setting this to non-empty string will set the server to enforce permissions on authorized_keys file.
• USE_OWN_HOST_KEYS - setting this to non-empty string will signal to the image that custom host keys are in use.

⁠Author

BTHLabs Docker Bastion is developed by Tomek Wójcik⁠.

⁠License

BTHLabs Docker Bastion is licensed under the MIT License.