[Bug]: Not possible to use Docker Remote Host via SSH

[suchja]

Testcontainers version

3.2.0

Using the latest Testcontainers version?

Yes

Host OS

MacOS with Parallels-VM running Windows

Host arch

x64

.NET version

6.0.400 (also tried 7.0.400 und .NET Framework 4.8)

Docker version

Client:
 Cloud integration: v1.0.35-desktop+001
 Version:           24.0.5
 API version:       1.43
 Go version:        go1.20.6
 Git commit:        ced0996
 Built:             Fri Jul 21 20:32:30 2023
 OS/Arch:           darwin/amd64
 Context:           desktop-linux

Server: Docker Desktop 4.22.1 (118664)
 Engine:
  Version:          24.0.5
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.6
  Git commit:       a61e2b4
  Built:            Fri Jul 21 20:35:45 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.21
  GitCommit:        3dce8eb055cbb6872793272b4f20ed16117344f8
 runc:
  Version:          1.1.7
  GitCommit:        v1.1.7-0-g860f061
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Docker info

Client:
 Version:    24.0.5
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.11.2-desktop.1
    Path:     /Users/lernmoment/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.20.2-desktop.1
    Path:     /Users/lernmoment/.docker/cli-plugins/docker-compose
  dev: Docker Dev Environments (Docker Inc.)
    Version:  v0.1.0
    Path:     /Users/lernmoment/.docker/cli-plugins/docker-dev
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.20
    Path:     /Users/lernmoment/.docker/cli-plugins/docker-extension
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v0.1.0-beta.6
    Path:     /Users/lernmoment/.docker/cli-plugins/docker-init
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /Users/lernmoment/.docker/cli-plugins/docker-sbom
  scan: Docker Scan (Docker Inc.)
    Version:  v0.26.0
    Path:     /Users/lernmoment/.docker/cli-plugins/docker-scan
  scout: Command line tool for Docker Scout (Docker Inc.)
    Version:  0.20.0
    Path:     /Users/lernmoment/.docker/cli-plugins/docker-scout

Server:
 Containers: 2
  Running: 2
  Paused: 0
  Stopped: 0
 Images: 12
 Server Version: 24.0.5
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 3dce8eb055cbb6872793272b4f20ed16117344f8
 runc version: v1.1.7-0-g860f061
 init version: de40ad0
 Security Options:
  seccomp
   Profile: unconfined
  cgroupns
 Kernel Version: 5.15.49-linuxkit-pr
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.773GiB
 Name: docker-desktop
 ID: 88bc9875-20c6-4947-9ca5-c64ddce2510c
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: daemon is not using the default seccomp profile

What happened?

I wanted to follow a simple Testcontainers Tutorial in my environment. I'm running an Intel Mac with Ventura 13.5.1. This runs Docker Desktop as well as Windows 11 Pro in a Parallels VM. As I don't want to run Docker inside the Parallels-VM, I thought it would be great to simply use the Docker Engine on my Mac as a remote Docker Host. I already had SSH configured so I updated my .testcontainers.properties file as follows:

docker.client.strategy=org.testcontainers.dockerclient.EnvironmentAndSystemPropertyClientProviderStrategy
docker.host=ssh://username@hostname

Running the example (see below) results in Exception: Unknown URL scheme ssh. There is no additional information what this means and where it comes from.

Relevant log output

No response

Additional information

After several hours of searching and trying different configurations, I came across dotnet#540 . Which sounds to me like this is causing the problem I have.

As my use case seems to be rare (at least I didn't find further reports), I accept that there will be no change. However, it would be really awesome, if the documentation could give a hint about this. For example a simple note like SSH is not supported for connecting to remote host. at this paragraph, would be really good.

Here is the example I've used (yes, it is VB.Net, but C# would be the same):

Module Module1

    Sub Main()
        Dim guid = TestContainer().GetAwaiter().GetResult()

        Console.WriteLine(guid)
        Console.ReadLine()
    End Sub

    Private Async Function TestContainer() As Task(Of String)
        Dim helloContainer = New ContainerBuilder().
            WithImage("testcontainers/helloworld:1.1.0").
            WithPortBinding(8080, True).
            WithWaitStrategy(Wait.ForUnixContainer().UntilHttpRequestIsSucceeded(Function(r) r.ForPort(8080))).
            Build()

        Await helloContainer.StartAsync().ConfigureAwait(False)
        Dim http As New HttpClient()
        Dim requestUriBuilder As New UriBuilder(Uri.UriSchemeHttp,
                                         helloContainer.Hostname,
                                         helloContainer.GetMappedPublicPort(8080),
                                         "uuid")

        Dim guid = Await http.GetStringAsync(requestUriBuilder.Uri).ConfigureAwait(False)

        Return guid
    End Function
End Module

[HofmeisterAn]

Unfortunately, this feature is not supported in Testcontainers for .NET due to limitations in Docker.DotNet. Until it becomes supported in Docker.DotNet, there is not much we can do, - sorry. For some time now, I have been considering generating and implementing a .NET client from the official OpenAPI specification, including adding support for various contexts, but I haven't had the time yet. As a workaround you can expose the Docker endpoint via HTTP (TCP).

[suchja]

@HofmeisterAn thanks for the blazingly fast response! I fully understand the situation and also saw dotnet#575 which might provide a solution, once it is finished.

Anyhow, the only change I propose to consider is to add a short statement in the docs. That would have saved me a ton of time. Thanks for your support.

PS: On my way to give TCP a try.
PPS: For any one who comes a cross this issue and is in the same situation like me, docker/for-mac#6165 might be interesting.

[HofmeisterAn]

I have started to look into generating the Docker client from the OpenAPI specification. A nice convolution is that we can utilize Testcontainers for implementing and testing the client. Unfortunately, it looks like there is a bit more work ahead of us (instead of just adding support for the missing "schemes"):

https://github.com/testcontainers/testcontainers-dotnet/blob/9c54684786d26c15feec9f6ea636414bd4aede38/tests/DockerEngine.Tests/DockerClientTest.cs#L37-L48

[HofmeisterAn]

I would like to share that we're now using our own fork of Docker.DotNet. If we add SSH support there, we'll be able to include it in Testcontainers as well.

[romerod]

Good morning,
I've run exactly into the same issue. To circumvent the problem I created a docker container which opened and ssh tunnel to another host and forwarded the local port 2375 to the remote host on port 2375. And then configured the DOCKER_HOST to tcp://{container_name}:2375 while my build was running in a sibling container in the same networt. Running "docker ps" in that container worked, but when running the tests I've got DotNet.Testcontainers.Containers.ResourceReaperException : Initialization has been cancelled.

So for now we will work with firewall rules and open tcp directly.

I wanted to point out, that there is a fork of Docker.DotNet which support SSH: https://github.com/TrapTech/Docker.DotNet.

[HofmeisterAn]

As mentioned, SSH isn't supported. But if someone's up for migrating the implementation (including tests) to our fork, I'd be more than happy to review it.

[HofmeisterAn]

I move this to our forked version. The issue is more related to Docker.DotNet, and we need to add support there first.