How to prevent forwarding SSH agent to Apptainer?
May 20, 10:29pm

To prevent forwarding the SSH agent to Apptainer containers, use the --no-env flag to block the SSH_AUTH_SOCK environment variable:

bash
apptainer run --no-env SSH_AUTH_SOCK my_container.sif

Why this works:

  • Apptainer passes most host environment variables (including SSH_AUTH_SOCK) to containers by default
  • The --no-env flag explicitly excludes specified variables from being imported
  • Without SSH_AUTH_SOCK, processes inside the container cannot locate your host's SSH agent socket

For complete isolation:

If your SSH agent socket resides in /tmp (the default location) and you want to prevent any possibility of access:

bash
apptainer run --no-env SSH_AUTH_SOCK --no-mount tmp my_container.sif

This blocks both the environment variable and the automatic /tmp mount where the socket typically exists.

May 20, 10:29pm

This is a shared conversation and may include unverified content that doesn't reflect Mistral AI's views. Login to resume chatting.

Vibe can make mistakes. Check answers. Learn more