[JENKINS-43050] SSH Agent plugin doesn't work well with docker pipelines

[jenkins-infra-bot]

I've tried

dockerImage.inside {
  sshagent([...]) {
    sh '...'
  }
}

and this appears to fail because the ssh-agent gets launched but then the next command
appears to be ssh-agent -k which kills the process before the sh step has a chance to run despite the sh command being inside the sshagent block.

And also

sshagent([...]){
  dockerImage.inside {
    sh '...'
  }
}

fails (I think) for a more predictable reason: the ssh-agent stays running and the env variables get
set correctly inside the container, however the socket is in /tmp on the container server which is not visible to the container (by default).

---

Originally reported by elatt, imported from: SSH Agent plugin doesn't work well with docker pipelines

• status: Open
• priority: Critical
• component(s): ssh-agent-plugin
• resolution: Unresolved
• votes: 3
• watchers: 9
• imported: 20260604-211335

Raw content of original issue

I've tried

dockerImage.inside {
  sshagent([...]) {
    sh '...'
  }
}


and this appears to fail because the ssh-agent gets launched but then the next command
appears to be ssh-agent -k which kills the process before the sh step has a chance to run despite the sh command being inside the sshagent block.
And also

sshagent([...]){
  dockerImage.inside {
    sh '...'
  }
}


fails (I think) for a more predictable reason: the ssh-agent stays running and the env variables get
set correctly inside the container, however the socket is in /tmp on the container server which is not visible to the container (by default).

[jenkins-infra-bot]

jglick:

• Original comment link
• Raw content of original comment:

  sshagent must indeed be inside inside.
  
  Not sure how to reproduce. It works for me.
  

sshagent must indeed be inside inside.

Not sure how to reproduce. It works for me.

[jenkins-infra-bot]

elatt:

• Original comment link
• Raw content of original comment:

  Hmm, you're right. I am now unable to reproduce the issue I was having.
  

Hmm, you're right. I am now unable to reproduce the issue I was having.

[jenkins-infra-bot]

jglick:

• Original comment link
• Raw content of original comment:

  If you have complete, minimal, self-contained steps to reproduce the issue from scratch, please add them here and reopen.
  

If you have complete, minimal, self-contained steps to reproduce the issue from scratch, please add them here and reopen.

[jenkins-infra-bot]

jglick:

• Original comment link
• Raw content of original comment:

  Not sure offhand, would have to spend time digging into it. The obvious workaround is to just not use the SSH Agent plugin, and run ssh-agent yourself. You are probably better off not using Docker Pipeline either; just write a Dockerfile that sets things up the way you need it.
  

Not sure offhand, would have to spend time digging into it. The obvious workaround is to just not use the SSH Agent plugin, and run ssh-agent yourself. You are probably better off not using Docker Pipeline either; just write a Dockerfile that sets things up the way you need it.

[jenkins-infra-bot]

mkj:

• Original comment link
• Raw content of original comment:

  Seeing same, when using:
  
  agent {
    docker {
      image 'myimage'
    }
  }
  
  
  I would see same as ihor_sviziev. Not for all commands though:
  I think plain commands work:
  
  sh "ssh user@remote.host.com rm -rf /"
  
  but not when I am opening ssh tunnel and executing commands in the tunnel itself.
   
  Also no issues with any commands (including more complex ones) when using agent { any } and executing directly on the Jenkins slave. So seems to be Docker-specific as well for me.
  

Seeing same, when using:

agent {
  docker {
    image 'myimage'
  }
}

I would see same as ihor_sviziev. Not for all commands though:

I think plain commands work:

sh "ssh user@​remote.host.com rm -rf /"

but not when I am opening ssh tunnel and executing commands in the tunnel itself.

 

Also no issues with any commands (including more complex ones) when using agent { any } and executing directly on the Jenkins slave. So seems to be Docker-specific as well for me.

[jenkins-infra-bot]

mkj:

• Original comment link
• Raw content of original comment:

  Any logging we can enable for the sshagent to see more details on where the issue is?
  

Any logging we can enable for the sshagent to see more details on where the issue is?

[jenkins-infra-bot]

kostyaripak:

• Original comment link
• Raw content of original comment:

  Well, I think I found how to reproduce the issue.
  
  The following code works as expected if running on non-docker agent and does not work inside docker:
  
   
  
  agent {
      docker {
          label 'bsp'
          image 'my-registry/my-image'
          reuseNode true
      }
  }
  stage("Some stage") {
      steps {
          sshagent(['some-id']) {
              script {
                 sh "# some code that uses ssh"
              }
          }
      }
  }
  
   
  However, if I put sshagent() inside script {...} block it works:
  
  agent {
      docker {
          label 'bsp'
          image 'my-registry/my-image'
          reuseNode true
      }
  }
  stage("Some stage") {
      steps {
          script {
              sshagent(['some-id']) {
                 sh "# some code that uses ssh"
              }
          }
      }
  }
  
   
  

Well, I think I found how to reproduce the issue.

The following code works as expected if running on non-docker agent and does not work inside docker:

 

agent {
    docker {
        label 'bsp'
        image 'my-registry/my-image'
        reuseNode true
    }
}
stage("Some stage") {
    steps {
        sshagent(['some-id']) {
    script {
       sh "# some code that uses ssh"
            }
        }
    }
}

 

However, if I put sshagent() inside script {...} block it works:

agent {
    docker {
        label 'bsp'
        image 'my-registry/my-image'
        reuseNode true
    }
}
stage("Some stage") {
    steps {
script {
    sshagent(['some-id']) {
       sh "# some code that uses ssh"
            }
        }
    }
}

 

[jenkins-infra-bot]

[Original blocks from Jira: JENKINS-36997]