sftp-only-container

Scope

container files and shell scripts for the IBM Developer tutorial sftp-only container for IBM zCX (or any other appliance-like container runtime).

Share volumes from the IBM z/OS Container Extension using SFTP on IBM Developer

Usage - Start the container

Requirements

• IBM Z Container Extension (zCX) - FMID HZDC7C0 - see z/OS 2.5 Requirements for zCX or
• other remote container runtime (docker or podman) e.g. podman machines on MacOS
• volume for /home to contain authorized_keys for ssh public key authentication
• volume for /Volume to host the hub of container volumes to mount onto

Start the container

Here is an example to start the container. The dummy_volume is an example of how to add another container volume to the sftp_only container.

$ docker run --name sftp-only --hostname sftp-only --rm -d -p 2022:22 \
-v sftp-home:/home -v sftp-volume:/Volume -v dummy_volume:/Volume/dummy \
-e SFTP_ONLY=yes thomasw/sftp-only:latest

Environment Variable	Values	description
SFTP_ONLY	yes / no	Default: no Set to yes if the container should restrict the access to sftp, and change the root to /Volume
DEBUG	0 numeric	Default: 0 (for no output) 1 or higher is more verbose

Usage User Administration

This can be done on the running container with docker exec or on the /home volume while stopped.

$ docker exec sftp-only containeradm
...

or

$ docker run --rm -v sftp-home:/home thomasw/sftp-only:latest containeradm
...

To get started you need to add a user and add his ssh public key like this:

$ docker exec sftp-only containeradm user add username
User username was added.
$ docker exec sftp-only containeradm key add \
"username:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFHe4Aqe5RbyC1d7Zco+EI9Q4VUvtwcLEHHURK02pe+B test-key"
added key to user username
$

Here is a list of the most important commands:

Task	Command
Add a user	... containeradm user add username or ... containeradm user add username:1000:1000
Delete a user	... containeradm user del username
List users	... containeradm user list
Add user to a group	... containeradm user addgrp username groupname
Remove user from a group	... containeradm user rmgrp username groupname
Add ssh public key	... containeradm key "username:ssh-ed25119 AAAA...."
List keys	... containeradm key list username
Dump the ssh config	... containeradm showconfig
Regenerate the hostkeys	... containeradm hostkey refresh

License

The Dockerfiles and associated shell scripts are licensed under the Apache License 2.0

All source files must include a Copyright and License header. The SPDX license header is preferred because it can be easily scanned.

If you would like to see the detailed LICENSE click here.

#
# Copyright 2020- IBM Inc. All rights reserved
# SPDX-License-Identifier: Apache2.0
#