Read host keys from environment variables

[Philipp Marek]

> It wouldn't have to be a different container: ssh-agent could be the 
> parent process of the sshd process. You would of course still have to 
> get the key into ssh-agent somehow. A startup script could read the 
> environment variable, ssh-add the key, then exec sshd with a cleaned 
> environment (retaining SSH_AUTH_SOCK, if you don't set a fixed path).

Yeah, something like this.


> Personally though, I would just mount the host key file into the 
> container, or have a startup script which reads the environment 
> variable and writes it to a tmpfs location; in either case with 
> permissions set for root-only access. This is, after all, the 
> traditional sshd security model used for decades: the host keys sit on 
> the filesystem in /etc/ssh/, protected only by filesystem permissions.

Yeah, but that doesn't work in plain containers
(without user namespaces to separate multiple unix users) --
everything in them runs as the same unix user.

And having user namespaces means higher-privileged containers,
which is another can of worms.