title: Jenkins: clone a private repository in a docker container
body: <p>I know there are numerous questions about this topic already here on SO, and I tried almost all of the solutions they came up with, but I'm currently at the point that I can't get it to work (the way I want that is).</p>
  
  <h2>Problem</h2>
  
  <p>I have docker container that is spinned up in Jenkins, and in this docker container I try to clone a private repository. To do this I need to add my public Jenkins key to my Git repository and my docker container needs to know this SSH key.</p>
  
  <h2>My current working solution</h2>
  
  <p>I am already able to do this by doing the following in my <code>Jenkinsfile</code>:</p>
  
  <pre><code>docker.image('php_jenkins_test').inside('--env COMPOSER_HOME=$WORKSPACE/.composer -v /etc/passwd:/etc/passwd:ro -v /home/jenkins/.ssh:/home/jenkins/.ssh:ro') {
      sshagent(['jenkins-ssh-publickey']) {
          sh "./test/run-tests.sh"
      }
  }
  </code></pre>
  
  <p>I mount my <code>etc/passwd</code> and <code>/home/jenkins/.ssh</code> as read-only volumes for the following reasons:</p>
  
  <ul>
  <li>The Jenkins Docker plugin runs as a Jenkins user. This users' UID and GID are not known inside my Docker container. Therefore I had to mount <code>/etc/passwd</code>.</li>
  <li>When pulling from the Git repo, my <code>known_hosts</code> (and my keys?) need to be known inside my docker container. Since <code>/etc/passwd</code> maps the jenkins users to <code>/home/jenkins</code>, I had to mount the SSH-directory of Jenkins on my guest machine as well.</li>
  <li>The <code>sshagent</code>-command sets up the SSH socket so that my keys are accessible within my container (correct me if I'm wrong, I'm fairly new to Jenkins and Docker).</li>
  </ul>
  
  <p>Like I said: this already works. With this setup I am able to clone private git repositories within my docker container within Jenkins.</p>
  
  <h2>So what's the problem then?</h2>
  
  <p>I find mounting of <code>/home/jenkins/.ssh</code> a bit... dangerous. I mount it as read-only, but I work in an organization with 70+ developers and if one of them takes my code as example and removes the <code>:ro</code>, chances are they are going to mess up Jenkins' <code>.ssh</code>-folder and this is very, very bad.</p>
  
  <p>So I'm looking for a method to clone private repositories without having to mount the <code>.ssh</code>-folder. After all, isn't that what the <code>sshagent</code>-plugin is for?</p>
  
  <h2>What I have tried so far</h2>
  
  <p>Since my docker container mounts the <code>/etc/passwd</code> it will look for a <code>/home/jenkins</code>-folder at some point in time. Since the <code>sshagent</code> will take care of the keys I figured I would only have to be concerned about the <code>known_hosts</code>-file. So I tried the following in my Dockerfile:</p>
  
  <pre><code>RUN mkdir -p /home/jenkins/.ssh
  RUN chmod 700 /home/jenkins/.ssh
  RUN ssh-keyscan -t rsa (url to git) &gt;&gt; /home/jenkins/.ssh/known_hosts
  </code></pre>
  
  <p>Unfortunately, this will create the directories and files under the <code>root</code>-user, so when I run my container as the <code>jenkins</code>-user (what the Jenkins docker plugin does), I cannot access <code>/home/jenkins/...</code>.</p>
  
  <p>So I tried doing it in a shell script in my container that is ran by the Jenkins user:</p>
  
  <pre><code>mkdir -p /home/jenkins/.ssh
  chmod 700 /home/jenkins/.ssh
  ssh-keyscan -t rsa (url to git) &gt;&gt; /home/jenkins/.ssh/known_hosts
  </code></pre>
  
  <p>Once again: no luck, since the jenkins-user is not allowed to create directories in <code>/home/</code>.</p>
  
  <p>So back to <code>Dockerfile</code>, let's try adding the following line:</p>
  
  <pre><code>RUN chown $(id -u $(whoami)):$(id -g $(whoami)) -R /home/jenkins
  </code></pre>
  
  <p>Again no luck, because <code>whoami</code> returns <code>root</code>, not <code>jenkins</code>. So let's just hard-code it in then:</p>
  
  <pre><code>RUN chown $(id -u jenkins):$(id -g jenkins) -R /home/jenkins
  </code></pre>
  
  <p>Once again, no luck. The message I get now is <em>"id: jenkins: no such user"</em>.</p>
  
  <h2>I'm stuck</h2>
  
  <p>So there you have it: I'm stuck. <strong>How can I clone private repositories in a docker container in Jenkins without having to mount the <code>.ssh</code>-folder?</strong> Any help on this topic is greatly appreciated. I'm staring at this for too long now...</p>