# Docker build ssh not propagated

**URL:** <https://discuss.circleci.com/t/docker-build-ssh-not-propagated/50207>\
**Category:** Build Environment\
**Tags:** docker, ssh\
**Created:** [January 12, 2024, 8:35pm UTC](https://discuss.circleci.com/t/docker-build-ssh-not-propagated/50207 "2024-01-12T20:35:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mauri](https://avatars.discourse-cdn.com/v4/letter/m/c67d28/32.png) [@mauri](https://discuss.circleci.com/u/mauri)\
**Post date:** [January 12, 2024, 8:35pm UTC](https://discuss.circleci.com/t/docker-build-ssh-not-propagated/50207/1 "2024-01-12T20:35:39Z")

</div>

Hello! I’m building a docker image that uses packages from private github repos using.

```auto
RUN --mount=type=ssh pip install -r requirements.txt

```

I invoke docker build with the `-ssh default` parameter. This doesn’t seem to be working on circleci. It runs as if no ssh keys were available during the build.

```auto
    steps:
      - add_ssh_keys:
          fingerprints:
          - "my:fi:ng:er:pr:in:t"
      - checkout
      - setup_remote_docker
      - run:
          name: build something
          command: |
            git clone git@github.com:company/private.git # this works OK!
            docker build --ssh default . # this FAILS because of missing credentials during the pip install line

```

This works ok on different environments, but can’t make it work on CircleCI

---

<div class="post-metadata">

**Author:** ![rit1010](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/rit1010/32/34738_2.png) [@rit1010](https://discuss.circleci.com/u/rit1010)\
**Post date:** [January 13, 2024, 4:17pm UTC](https://discuss.circleci.com/t/docker-build-ssh-not-propagated/50207/2 "2024-01-13T16:17:31Z")

</div>

One common issue is documented here, with a solution provided

> **[Build secrets and SSH forwarding in Docker 18.09](https://medium.com/@tonistiigi/build-secrets-and-ssh-forwarding-in-docker-18-09-ae8161d066)**
>
> One of the complexities when using Dockerfiles has always been accessing private resources. If you need to access some private repository…

As part of the ssh session, the remote system’s public key must be downloaded and docker build does not automate this step so the ssh session fails as ssh’s default action is to prompt for key verification.

---

<div class="post-metadata">

**Author:** ![mauri](https://avatars.discourse-cdn.com/v4/letter/m/c67d28/32.png) [@mauri](https://discuss.circleci.com/u/mauri)\
**Post date:** [January 17, 2024, 2:02pm UTC](https://discuss.circleci.com/t/docker-build-ssh-not-propagated/50207/3 "2024-01-17T14:02:37Z")

</div>

They ssh-agent do work on docker build, but the problem was related to two identities present in the agent. Not only the key I explicitly added by fingerprint, but also the default job one.

This two identities were able to connect to github but the first one, added automatically, didn’t have permissions to pull my repository.

I fixed it by dropping the first identity, added automatically, from the agent right before running docker build

```auto
      - run:
          name: my build
          command: |
            ssh-add -d <(ssh-add -L | head -1)
            docker build --ssh default=${SSH_AUTH_SOCK} .

```