Support `ADD` cloning git repository recursive submodules via SSH

[MisterDA]

Description

The Dockerfile ADD instruction can add files from a git repository. My understanding is that it improves caching over RUN git clone.

To add a repository via SSH, whether public or private, you must pass an SSH key for authentication.

ADD git@github.com:user/repo.git /usr/src/things/

If however the git repository submodules can only be fetched via ssh, then, unless I'm mistaken, ADD is unable to fetch them. One has to resort to ssh mounts to be able to do RUN --mount=type=ssh git clone --recursive ....

Could ADD be enhanced to fetch the submodules via SSH, too?

Thanks!

[tonistiigi]

I don't know what exactly is the issue here. ADD allows SSH URLs and submodules should be fetched as well (you may need to enable --keep-git-dir for that.

[MisterDA]

This is essentially my Dockerfile:

# syntax=docker/dockerfile:1
FROM ubuntu:latest
ADD --keep-git-dir ssh://git@git.example.com:xxxx/repo.git /mnt

which I build with Docker on macOS Sequoia 15.5 (Docker version 28.3.0, build 38b7060)

docker build --ssh default=$SSH_AUTH_SOCK --platform linux/x86_64 - < ./Dockerfile

[stage-0 6/6] ADD --keep-git-dir ssh://git@git.example.com:xxxx/repo.git /mnt
ref: refs/heads/master HEAD
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc HEAD
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc refs/heads/master
ref: refs/heads/master HEAD
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc HEAD
From ssh://git.example.com:xxxx/repo
* [new branch] master -> master
* [new branch] master -> origin/master
Initialized empty Git repository in /var/lib/desktop-containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/4277/fs/.git/
commit
From file:///var/lib/desktop-containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/4275/fs
* [new tag] master -> master
* [new tag] master -> master
Note: switching to 'FETCH_HEAD'.
You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.
If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:
git switch -c <new-branch-name>
Or undo this operation with:
git switch -
Turn off this advice by setting config variable advice.detachedHead to false
HEAD is now at adc83b19 Merge branch 'branch-name' into 'master'
Submodule 'submodule' (ssh://xxxxx@git.example.com:xxxx/submodule.git) registered for path 'path_to_submodule'
Cloning into '/var/lib/desktop-containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/4277/fs/path_to_submodule'...
xxxxx@git.example.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
fatal: clone of 'ssh://xxxxx@git.example.com:xxxx/submodule.git' into submodule path '/var/lib/desktop-containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/4277/fs/path_to_submodule' failed
Failed to clone 'path_to_submodule_0'. Retry scheduled
Cloning into '/var/lib/desktop-containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/4277/fs/path_to_submodule'...
xxxxx@git.example.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
fatal: clone of 'ssh://xxxxx@git.example.com:xxxx/submodule.git' into submodule path '/var/lib/desktop-containerd/daemon/io.containerd.snapshotter.v1.overlayfs/snapshots/4277/fs/path_to_submodule' failed
Failed to clone 'path_to_submodule' a second time, aborting

To me it seems that the ssh secret key is not picked when cloning the submodules. A RUN --mount=type=ssh git clone --recursive ssh://git@git.example.com:xxxx/repo.git /mnt works. My ssh config has this:

Host git.example.com
     Port xxxx
     IdentitiesOnly yes
     IdentityFile ~/.ssh/id_ed25519_example

Thanks for any help!

[tonistiigi]

@MisterDA Indeed there seems to be a bug in here. SSH socket is not passed to the submodules request https://github.com/moby/buildkit/blob/v0.23.2/source/git/source.go#L668-L669 like it is passed for the main fetch request https://github.com/moby/buildkit/blob/v0.23.2/source/git/source.go#L752-L753

[MisterDA]

Wow, nice! Is that an easy fix?