From 9b305c9f7eefd97a47957ac27dcd3a12ae19a966 Mon Sep 17 00:00:00 2001 From: Joakim Persson Date: Tue, 26 May 2026 18:29:00 +0000 Subject: [PATCH] Doc: note SSH ControlMaster fix arrives via opencode-devbox base Symmetric with the gitleaks/git-crypt inherit-note already present. Cross-references opencode-devbox commit 668592d (Unreleased), which bakes /etc/ssh/ssh_config.d/00-devbox-controlmaster.conf with a writable /tmp/sshcm ControlPath. pi-devbox picks this up automatically on its next build against base-latest; no Dockerfile change here. Documents the symptom users see today inside pi-devbox <= v0.75.5b (unix_listener Read-only file system on \~/.ssh/cm) and the fact that pi --ssh user@host inside the container is currently silently broken until the cascade lands. --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9dbabf8..8cf2379 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ Tags follow the pi npm version: `v{pi_version}[letter]` — bare tag for the fir ## Unreleased +### Inherited from opencode-devbox base: SSH ControlMaster on a writable socket path + +No Dockerfile change here — just a note that the next pi-devbox release built against a fresh `joakimp/opencode-devbox:base-latest` will pick up the system-wide SSH ControlMaster default (`/etc/ssh/ssh_config.d/00-devbox-controlmaster.conf` → `ControlPath /tmp/sshcm/%r@%h:%p`, `ControlMaster auto`, `ControlPersist 10m`). This unblocks `ssh` and `pi --ssh user@host` from inside the container when `~/.ssh` is bind-mounted read-only from the host (the standard pi-devbox compose layout) — previously, OpenSSH's default `ControlPath` under `~/.ssh/cm/` was unwritable, so multiplexing failed with `unix_listener: cannot bind ... Read-only file system` and ssh fell back to fresh TCP connections, which on residential CGNAT manifested as banner-exchange timeouts. The fix is purely additive (per-container `/tmp/sshcm` dir, mode 700, created by entrypoint) and user `~/.ssh/config` per-host overrides still win because Debian's stock `ssh_config` sources `ssh_config.d/*.conf` before its own `Host *` block. See opencode-devbox CHANGELOG `Unreleased` for the base-side details. + ### Inherited from opencode-devbox base: gitleaks + git-crypt No Dockerfile change here — just a note that the next pi-devbox release built against a fresh `joakimp/opencode-devbox:base-latest` will include `gitleaks` (newly added to the base) and `git-crypt` (was always installed via apt; just wasn't called out). Both are useful inside the container for repos that use a gitleaks pre-commit hook or git-crypt-encrypted canonical config and don't want host-side dependencies. See opencode-devbox CHANGELOG `Unreleased` for the base-side details.