Awesome
<p align="center"> <img src="https://raw.githubusercontent.com/serversideup/docker-ssh/main/.github/header.png" width="1200" alt="Docker Images Logo"> </p> <p align="center"> <a href="https://actions-badge.atrox.dev/serversideup/docker-ssh/goto?ref=main"><img alt="Build Status" src="https://img.shields.io/endpoint.svg?url=https%3A%2F%2Factions-badge.atrox.dev%2Fserversideup%2Fdocker-ssh%2Fbadge%3Fref%3Dmain&style=flat" /></a> <a href="https://github.com/serversideup/docker-ssh/blob/main/LICENSE" target="_blank"><img src="https://badgen.net/github/license/serversideup/docker-ssh" alt="License"></a> <a href="https://github.com/sponsors/serversideup"><img src="https://badgen.net/badge/icon/Support%20Us?label=GitHub%20Sponsors&color=orange" alt="Support us"></a> <a href="https://community.serversideup.net"><img alt="Discourse users" src="https://img.shields.io/discourse/users?color=blue&server=https%3A%2F%2Fcommunity.serversideup.net"></a> <a href="https://serversideup.net/discord"><img alt="Discord" src="https://img.shields.io/discord/910287105714954251?color=blueviolet"></a> </p>Introduction
serversideup/docker-ssh
is a hardened SSH server container based on Debian. It works great if you need to create a secure tunnel into your cluster.
Features
- đ§ Debian-based - Get a lightweight experience, while still having Bash
- đ¤ Key-based auth via ENV - Grant access with the
AUTHORIZED_KEYS
environment variable - âī¸ Block IPs via ENV - Block access with the
ALLOWED_IPS
environment variable - đ Unprivileged user - All SSH connections are made as an unprivileged user
- đ Set your own PUID and PGID - Have the PUID and PGID match your host user
- đ Hardened SSH - Prevent bot attacks and ensure quality security
- đĻ DockerHub and GitHub Container Registry - Choose where you'd like to pull your image from
- đ¤ Multi-architecture - Every image ships with x86_64 and arm64 architectures
Usage
This is a list of the docker images this repository creates:
Image | Image Size | Description |
---|---|---|
serversideup/docker-ssh | A hardened SSH server based on Debian Bookworm. |
Usage instructions
All variables are documented here:
đ Variable Name | đ Description | #ī¸âŖ Default Value |
---|---|---|
ALLOWED_IPS | Content of allowed IP addresses (see below) | AllowUsers tunnel (allow the tunnel user from any IP) |
AUTHORIZED_KEYS | đ¨ <b>Required to be set by you.</b> Content of your authorized keys file (see below) | |
DEBUG | Display a bunch of helpful content for debugging. | false |
PGID | Group ID the SSH user should run as. | 9999 |
PUID | User ID the SSH user should run as. | 9999 |
SSH_GROUP | Group name used for our SSH user. | tunnelgroup |
SSH_HOST_KEY_DIR | Location of where the SSH host keys should be stored. | /etc/ssh/ssh_host_keys/ |
SSH_PORT | Listening port for SSH server (on container only. You'll still need to publish this port). | 2222 |
SSH_USER | Username for the SSH user that other users will connect into as. | tunnel |
1. Set your AUTHORIZED_KEYS
environment variable or provide a /authorized_keys
file
You can provide multiple keys by loading the contents of a file into an environment variable.
AUTHORIZED_KEYS="$(cat .ssh/my_many_ssh_public_keys_in_one_file.txt)"
Or you can provide the authorized_keys
file via a volume. Ensure the volume references matches the path of /authorized_keys
. The image will automatically take the file from /authorized_keys
and configure it for use with your selected user.
âšī¸ NOTE: If both a file and variable are provided, the image will respect the value of the variable over the file.
2. Set your ALLOWED_IPS
environment variable
Set this in the same context of AllowUsersThis example shows a few scenarios you can do:
ALLOWED_IPS="AllowUsers *@192.168.1.0/24 *@172.16.0.1 *@10.0.*.1"
3. Forward your external port to 2222
on the container
You can see I'm forwarding 12345
to 2222
.
docker run --rm --name=ssh --network=web -p 12345:2222 localhost/ssh
This means I would connect with:
ssh -p 12345 tunnel@myserver.test
Working example with MariaDB + SSH + Docker Swarm
Here's a perfect example how you can use it with MariaDB. This allows you to use Sequel Pro or TablePlus to connect securely into your database server đĨŗ
Example using ALLOWED_IPS
variable:
services:
mariadb:
image: mariadb:10.11
networks:
- database
environment:
MARIADB_ROOT_PASSWORD: "myrootpassword"
ssh:
image: serversideup/docker-ssh
ports:
- target: 2222
published: 2222
mode: host
# Set the Authorized Keys of who can connect
environment:
AUTHORIZED_KEYS: >
"# Start Keys
ssh-ed25519 1234567890abcdefghijklmnoqrstuvwxyz user-a
ssh-ed25519 abcdefghijklmnoqrstuvwxyz1234567890 user-b
# End Keys"
# Lock down the access to certain IP addresses
ALLOWED_IPS: "AllowUsers tunnel@1.2.3.4"
networks:
- database
networks:
database:
Example using $SSH_USER_HOME/.ssh/authorized_keys
file:
services:
mariadb:
image: mariadb:10.11
networks:
- database
environment:
MARIADB_ROOT_PASSWORD: "myrootpassword"
ssh:
image: serversideup/docker-ssh
ports:
- target: 2222
published: 2222
mode: host
# Set the Authorized Keys of who can connect
environment:
# Lock down the access to certain IP addresses
ALLOWED_IPS: "AllowUsers tunnel@1.2.3.4"
configs:
- source: ssh_authorized_keys
# Mount the file to "/authorized_keys". The image will handle everything else
target: /authorized_keys
mode: 0600
networks:
- database
# Define the config to be used
configs:
ssh_authorized_keys:
file: ./authorized_keys
networks:
database:
Resources
- DockerHub to browse the images.
- Discord for friendly support from the community and the team.
- GitHub for source code, bug reports, and project management.
- Get Professional Help - Get video + screen-sharing help directly from the core contributors.
Contributing
As an open-source project, we strive for transparency and collaboration in our development process. We greatly appreciate any contributions members of our community can provide. Whether you're fixing bugs, proposing features, improving documentation, or spreading awareness - your involvement strengthens the project. Please review our code of conduct to understand how we work together respectfully.
- Bug Report: If you're experiencing an issue while using these images, please create an issue.
- Feature Request: Make this project better by submitting a feature request.
- Documentation: Improve our documentation by submitting a documentation change.
- Community Support: Help others on GitHub Discussions or Discord.
- Security Report: Report critical security issues via our responsible disclosure policy.
Need help getting started? Join our Discord community and we'll help you out!
<a href="https://serversideup.net/discord"><img src="https://serversideup.net/wp-content/themes/serversideup/images/open-source/join-discord.svg" title="Join Discord"></a>
Our Sponsors
All of our software is free an open to the world. None of this can be brought to you without the financial backing of our sponsors.
<p align="center"><a href="https://github.com/sponsors/serversideup"><img src="https://521public.s3.amazonaws.com/serversideup/sponsors/sponsor-box.png" alt="Sponsors"></a></p>Black Level Sponsors
<a href="https://sevalla.com"><img src="https://serversideup.net/wp-content/uploads/2024/10/sponsor-image.png" alt="Sevalla" width="546px"></a>
Bronze Sponsors
<!-- bronze -->No bronze sponsors yet. <a href="https://github.com/sponsors/serversideup">Become a sponsor â</a><!-- bronze -->Individual Supporters
<!-- supporters --><a href="https://github.com/GeekDougle"><img src="https://github.com/GeekDougle.png" width="40px" alt="GeekDougle" /></a> <a href="https://github.com/JQuilty"><img src="https://github.com/JQuilty.png" width="40px" alt="JQuilty" /></a> <a href="https://github.com/MaltMethodDev"><img src="https://github.com/MaltMethodDev.png" width="40px" alt="MaltMethodDev" /></a> <!-- supporters -->About Us
We're Dan and Jay - a two person team with a passion for open source products. We created Server Side Up to help share what we learn.
<div align="center"><div align="center">Dan Pastori</div> | <div align="center">Jay Rogers</div> |
---|---|
<div align="center"><a href="https://twitter.com/danpastori"><img src="https://serversideup.net/wp-content/uploads/2023/08/dan.jpg" title="Dan Pastori" width="150px"></a><br /><a href="https://twitter.com/danpastori"><img src="https://serversideup.net/wp-content/themes/serversideup/images/open-source/twitter.svg" title="Twitter" width="24px"></a><a href="https://github.com/danpastori"><img src="https://serversideup.net/wp-content/themes/serversideup/images/open-source/github.svg" title="GitHub" width="24px"></a></div> | <div align="center"><a href="https://twitter.com/jaydrogers"><img src="https://serversideup.net/wp-content/uploads/2023/08/jay.jpg" title="Jay Rogers" width="150px"></a><br /><a href="https://twitter.com/jaydrogers"><img src="https://serversideup.net/wp-content/themes/serversideup/images/open-source/twitter.svg" title="Twitter" width="24px"></a><a href="https://github.com/jaydrogers"><img src="https://serversideup.net/wp-content/themes/serversideup/images/open-source/github.svg" title="GitHub" width="24px"></a></div> |
Find us at:
- đ Blog - Get the latest guides and free courses on all things web/mobile development.
- đ Community - Get friendly help from our community members.
- đ¤ĩââī¸ Get Professional Help - Get video + screen-sharing support from the core contributors.
- đģ GitHub - Check out our other open source projects.
- đĢ Newsletter - Skip the algorithms and get quality content right to your inbox.
- đĨ Twitter - You can also follow Dan and Jay.
- â¤ī¸ Sponsor Us - Please consider sponsoring us so we can create more helpful resources.
Our products
If you appreciate this project, be sure to check out our other projects.
đ Books
- The Ultimate Guide to Building APIs & SPAs: Build web & mobile apps from the same codebase.
- Building Multi-Platform Browser Extensions: Ship extensions to all browsers from the same codebase.
đ ī¸ Software-as-a-Service
- Bugflow: Get visual bug reports directly in GitHub, GitLab, and more.
- SelfHost Pro: Connect Stripe or Lemonsqueezy to a private docker registry for self-hosted apps.
đ Open Source
- AmplitudeJS: Open-source HTML5 & JavaScript Web Audio Library.
- Spin: Laravel Sail alternative for running Docker from development â production.
- Financial Freedom: Open source alternative to Mint, YNAB, & Monarch Money.