Add support for sshfs

[osinside]

Add support for sshfs

[schaefi]

@davidcassany Thanks for adding the issue 👍 I signed up for some tasks on the kiwi project. If my time permits I take a look into this one.

[davidcassany]

@schaefi I'd say we need to run from host to boxed kiwi VM something like this script, a reverse sshfs, so the VM has sshfs installed and the host requires only the ssh client.

[schaefi]

@davidcassany yes the sshfs needs to be performed from the VM, otherwise it will be hard to do it right because we don't know when the network is up. I have started an implementation in the referenced branch. This is not complete so no PR yet

Currently I have the issue that the sshfs call is interactive, you need to provide the passphrase. The only good way I can imaging to overcome this is to inject an insecure private key into the boxes and document that users should add the public key into the authorized_keys file of that user which is calling boxbuild

But maybe there are better solutions ? Would be nice if you can take a short look at the code change. I appreciate your feedback if I'm on the right track with this.

Thanks much

[davidcassany]

@schaefi I'd say we need to run from host to boxed kiwi VM something like this script, a reverse sshfs, so the VM has sshfs installed and the host requires only the ssh client.

@davidcassany yes the sshfs needs to be performed from the VM, otherwise it will be hard to do it right because we don't know when the network is up. I have started an implementation in the referenced branch. This is not complete so no PR yet

Currently I have the issue that the sshfs call is interactive, you need to provide the passphrase. The only good way I can imaging to overcome this is to inject an insecure private key into the boxes and document that users should add the public key into the authorized_keys file of that user which is calling boxbuild

But maybe there are better solutions ? Would be nice if you can take a short look at the code change. I appreciate your feedback if I'm on the right track with this.

Thanks much

The problem I see in your approach is that the VM creates the SSH connection to the host. My idea was that the host connects to the VM via ssh to run sshfs reusing the SSH connection. Yes, this is a more complicated setup (we also need retires and timeout to wait for the guest network to be up and ready), but has the benefit that only requires having an SSH client on the host. No need for an ssh server with customized configuration. AFAIK this is what lima-vm/lima does, even I did not really understand all the details there, they use a heavy customized SSH setup no only for sshfs.

Regarding the insecure private key I agree this is the way. I would ship the insecure private key in images and then have the public key included in kiwi-boxed-plugin so when connecting from the host to the VM create the connection using the public key. All transparent to the user, no specific SSH configuration required beyond having an openssh client available.

what you think? does it makes sense? I'll try to experiment and setup such a reverse sshfs in a VM and share my findings.

[davidcassany]

My idea was that the host connects to the VM via ssh to run sshfs reusing the SSH connection. Yes, this is a more complicated setup (we also need retires and timeout to wait for the guest network to be up and ready), but has the benefit that only requires having an SSH client on the host. No need for an ssh server with customized configuration. AFAIK this is what lima-vm/lima does, even I did not really understand all the details there, they use a heavy customized SSH setup no only for sshfs.

OK I think this is not as simple as I thought... I start to think that probably lima makes use of the host/guest agents to run some sort of sftp server on the host. I am puzzled about how they do it, I can't see any running stfp server in host neither in guest. Anyway after trying to read more about sshfs I realized it absolutely depends on having a sftp server on the remote. So looks like my idea of requiring only ssh client from the host doesn't really make sense.

Edit: I think I found what lima project does, the lima host agent is based on sshocker (another project under lima-vm organization), which basically does ssh + reverse sshfs by providing the stfp server. Probably this is an interesting tool to consider.

Anyway I am sorry this task it not being as simple and straight forward as I though. At the beginning I though that installing sshfs on build box and some ssh_config kung-fu would be enough to get this done, but I see it is not that straight forward as it involves running services on the host.

[schaefi]

Anyway I am sorry this task it not being as simple and straight forward as I though

yes it was tricky but I found a way to implement it and will create a PR next to discuss it. Thanks much for all your feedback