How to use with a yubikey or a key with a password ?

[noahfraiture]

Hello,
I have a yubikey that requires a pin and a touch and lazydocker is unusable with docker context, because it require to constantly give authorization and won't actually even startup.
How do you manage that ?

[gitsult4n]

lazydocker does not open an ssh connection per request
for an ssh:// docker host it spawns one tunnel and repoints DOCKER_HOST at a local socket

pkg/commands/ssh/ssh.go:152

cmd := exec.CommandContext(ctx, "ssh", "-L", localSocket+":/var/run/docker.sock", host, "-N")

pkg/commands/docker.go:110-116 does the same for a docker context whose endpoint is ssh:// (v0.24.0 and later — before that only the DOCKER_HOST env var triggered it)

so one touch should be enough
the reason it never starts is that this child ssh gets no stdin
Go leaves cmd.Stdin nil which is the null device so a PIN prompt has nowhere to go
after 8 seconds you get ssh tunneled socket never became available
pkg/commands/ssh/ssh.go:102-108

fix is to authenticate before lazydocker runs and let it reuse the session

Host dockerhost
  ControlMaster auto
  ControlPath ~/.ssh/cm-%r@%h:%p
  ControlPersist 30m

then

ssh -N -f dockerhost   # one PIN + one touch
lazydocker

the -L inside lazydocker now attaches to the master socket and asks for nothing

keep the PIN cached in an agent as well (gpg-agent default-cache-ttl or yubikey-agent) so only the touch is left

one limit
the remote path in that -L is hardcoded to /var/run/docker.sock
for rootless docker build the tunnel yourself and point DOCKER_HOST=unix:///tmp/yoursock at it