Read host keys from environment variables

[Brian Candler]

On 11/08/2026 13:22, Philipp Marek wrote:
> Yeah, but that doesn't work in plain containers
> (without user namespaces to separate multiple unix users) --
> everything in them runs as the same unix user.
>
Something like podman perhaps?  It might be worth describing your use 
case in more detail.

If you're running sshd and the spawned sftp sessions as the same unix 
user, then I'd expect anyone who breaks out of an sftp session would be 
able to access anything that sshd can, including its host key (and its 
environment for that matter).


> And having user namespaces means higher-privileged containers,
> which is another can of worms. 

The container environments I use (primarily incus these days) use 
/etc/subuid and /etc/subgid to map containers to uids 1000000+U where U 
is the uid in the container. Generally these are lower privileged 
containers.