Read host keys from environment variables

[Brian Candler]

On 11/08/2026 10:45, Philipp Marek via openssh-unix-dev wrote:
> I saw "HostKeyAgent", but providing a unix-socket to a different 
> container
> running an agent with the keys is more complex and more likely to fail 
> than
> using environment variables. 

It wouldn't have to be a different container: ssh-agent could be the 
parent process of the sshd process. You would of course still have to 
get the key into ssh-agent somehow. A startup script could read the 
environment variable, ssh-add the key, then exec sshd with a cleaned 
environment (retaining SSH_AUTH_SOCK, if you don't set a fixed path).

Personally though, I would just mount the host key file into the 
container, or have a startup script which reads the environment variable 
and writes it to a tmpfs location; in either case with permissions set 
for root-only access. This is, after all, the traditional sshd security 
model used for decades: the host keys sit on the filesystem in 
/etc/ssh/, protected only by filesystem permissions.

The assumption is that anyone who has root on your system (or inside 
your container) can do anything they like. That they are able to MITM 
your ssh connections is the least of your worries.

But if that still is what worries you, then use host certificates with a 
short lifetime (and change the key for each new cert).