stdlib: docker: support running containers on the local docker engine

Depends on #570 Signed-off-by: Andrea Luzzardi <aluzzardi@gmail.com>
2021-06-04 16:57:31 -07:00 · 2021-06-04 16:57:31 -07:00 · ce5accd09c
commit ce5accd09c
parent 4365541d4d
23 changed files with 325 additions and 181 deletions
--- a/stdlib/docker/docker.cue
+++ b/stdlib/docker/docker.cue
@ -1,6 +1,8 @@
 package docker

 import (
+	"strconv"
+
 	"dagger.io/dagger"
 	"dagger.io/dagger/op"
 )
@ -42,23 +44,26 @@ import (
 }

 #Run: {
-	// Remote host
+	// Connect to a remote SSH server
+	ssh?: {
+		// ssh host
 		host: string @dagger(input)

-	// Remote user
+		// ssh user
 		user: string @dagger(input)

-	// Ssh remote port
+		// ssh port
 		port: *22 | int @dagger(input)

-	// Ssh private key
+		// private key
 		key: dagger.#Secret @dagger(input)

-	// User fingerprint
+		// fingerprint
 		fingerprint?: string @dagger(input)

-	// Ssh passphrase
-	passphrase?: dagger.#Secret @dagger(input)
+		// ssh key passphrase
+		keyPassphrase?: dagger.#Secret @dagger(input)
+	}

 	// Image reference (e.g: nginx:alpine)
 	ref: string @dagger(input)
@ -74,12 +79,14 @@ import (
 	} @dagger(input)

 	#code: #"""
-	export DOCKER_HOST="ssh://$DOCKER_USERNAME@$DOCKER_HOSTNAME:\#(port)"
+		if [ -n "$DOCKER_HOSTNAME" ]; then
+			export DOCKER_HOST="ssh://$DOCKER_USERNAME@$DOCKER_HOSTNAME:$DOCKER_PORT"

 			# Start ssh-agent
 			eval $(ssh-agent) > /dev/null

 			# Add key
+			if [ -f "/key" ]; then
 				message="$(ssh-keygen -y -f /key < /dev/null 2>&1)" || {
 					>&2 echo "$message"
 					exit 1
@ -89,6 +96,7 @@ import (
 				if [ "$?" != 0 ]; then
 					exit 1
 				fi
+			fi

 			if [[ ! -z $FINGERPRINT ]]; then
 				mkdir -p "$HOME"/.ssh
@ -97,7 +105,8 @@ import (
 				echo "$FINGERPRINT" >> "$HOME"/.ssh/known_hosts
 			else
 				# Add host to known hosts
-		ssh -i /key -o "UserKnownHostsFile "$HOME"/.ssh/known_hosts" -o "StrictHostKeyChecking accept-new" -p \#(port) "$DOCKER_USERNAME"@"$DOCKER_HOSTNAME" /bin/true > /dev/null 2>&1
+				ssh -i /key -o "UserKnownHostsFile "$HOME"/.ssh/known_hosts" -o "StrictHostKeyChecking accept-new" -p "$DOCKER_PORT" "$DOCKER_USERNAME"@"$DOCKER_HOSTNAME" /bin/true > /dev/null 2>&1
+			fi
 		fi


@ -108,7 +117,7 @@ import (
 			OPTS="$OPTS --name $CONTAINER_NAME"
 		fi

-	docker container run -d $OPTS \#(ref)
+		docker container run -d $OPTS "$IMAGE_REF"
 		"""#

 	#up: [
@ -118,7 +127,7 @@ import (
 			op.#DockerLogin & {registry}
 		},

-		if passphrase != _|_ {
+		if ssh.keyPassphrase != _|_ {
 			op.#WriteFile & {
 				content: #"""
 					#!/bin/bash
@ -145,23 +154,32 @@ import (
 				"/entrypoint.sh",
 			]
 			env: {
-				DOCKER_HOSTNAME: host
-				DOCKER_USERNAME: user
-				if passphrase != _|_ {
+				IMAGE_REF: ref
+				if ssh != _|_ {
+					DOCKER_HOSTNAME: ssh.host
+					DOCKER_USERNAME: ssh.user
+					DOCKER_PORT:     strconv.FormatInt(ssh.port, 10)
+					if ssh.keyPassphrase != _|_ {
 						SSH_ASKPASS: "/get_passphrase"
 						DISPLAY:     "1"
 					}
+					if ssh.fingerprint != _|_ {
+						FINGERPRINT: ssh.fingerprint
+					}
+				}
 				if name != _|_ {
 					CONTAINER_NAME: name
 				}
-				if fingerprint != _|_ {
-					FINGERPRINT: fingerprint
-				}
 			}
 			mount: {
-				"/key": secret: key
-				if passphrase != _|_ {
-					"/passphrase": secret: passphrase
+				if ssh == _|_ {
+					"/var/run/docker.sock": "docker.sock"
+				}
+				if ssh.key != _|_ {
+					"/key": secret: ssh.key
+				}
+				if ssh.keyPassphrase != _|_ {
+					"/passphrase": secret: ssh.keyPassphrase
 				}
 			}
 		},
--- a/tests/stdlib.bats
+++ b/tests/stdlib.bats
@ -95,16 +95,20 @@ setup() {
 }

@test "stdlib: docker: run" {
-    # Simple run
-    run "$DAGGER" up -w "$TESTDIR"/stdlib/docker/run/simple/
+    # Local run
+    run "$DAGGER" up -w "$TESTDIR"/stdlib/docker/run/local/
    assert_success

-    # Protected ssh key
-    run "$DAGGER" up -w "$TESTDIR"/stdlib/docker/run/passphrase/
+    # SSH key
+    run "$DAGGER" up -w "$TESTDIR"/stdlib/docker/run/ssh/
    assert_success

-    # Protected ssh key with wrong passphrase
-    run "$DAGGER" up -w "$TESTDIR"/stdlib/docker/run/wrong-passphrase/
+    # SSH passphrase
+    run "$DAGGER" up -w "$TESTDIR"/stdlib/docker/run/ssh-passphrase/
+    assert_success
+
+    # Wrong passphrase
+    run "$DAGGER" up -w "$TESTDIR"/stdlib/docker/run/ssh-wrong-passphrase/
    assert_failure
 }

--- a/tests/stdlib/docker/run/passphrase/.dagger/env/default/.gitignore
+++ b/tests/stdlib/docker/run/passphrase/.dagger/env/default/.gitignore
--- a/tests/stdlib/docker/run/local/.dagger/env/default/plan/local.cue
+++ b/tests/stdlib/docker/run/local/.dagger/env/default/plan/local.cue
@ -0,0 +1,15 @@
+package docker
+
+import (
+	"dagger.io/docker"
+	"dagger.io/dagger"
+)
+
+TestRun: {
+	random: #Random & {}
+
+	run: docker.#Run & {
+		name: "daggerci-test-local-\(random.out)"
+		ref:  "hello-world"
+	}
+}
--- a/tests/stdlib/docker/run/passphrase/.dagger/env/default/plan/random.cue
+++ b/tests/stdlib/docker/run/passphrase/.dagger/env/default/plan/random.cue
--- a/tests/stdlib/docker/run/local/.dagger/env/default/values.yaml
+++ b/tests/stdlib/docker/run/local/.dagger/env/default/values.yaml
@ -0,0 +1,21 @@
+name: default
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1gxwmtwahzwdmrskhf90ppwlnze30lgpm056kuesrxzeuyclrwvpsupwtpk
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpamtuNHB6NjY5L3VNT3hl
+            TGlmVFFoZURJR1RmZEFvSGUyVFRaSWNnSUMwClJiaDVGZWJoeDBMY21jZTVlREdS
+            aWg0SjNWN3BrTXRneXJyZy80K1JRSFUKLS0tIFEwKzdkVkNPT2VHTmtiOEdDQlZa
+            cnh2eHU5TzFjVkNvTzUyczFBL0pwTDQK60+wrLmTaD3Ws5ZAXdqBkMjaVP7Iz69k
+            UrkqkMbaUlvvSKK7dB5MuTGEEN6A1viAGal9ZjDHlSobkNPuE24QEA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2021-06-04T23:50:06Z"
+    mac: ENC[AES256_GCM,data:GTsG9ekL5O04qwUSBb4hqRgQIiXL7keLXLt0gWpwLe0KUTu/JojAt0ALTiU8m5QWGy2q/avKIql8xR3SWWuBahOsKeObFbnx6PbVpU5QvZZKA8c72m2C+fDE82eKT3qZoTbwBEY3A/7v9BsFSCgkg3Hb91zVnBlXjiD949YAgP4=,iv:sYDEUDjyYJCoJFRP7EG19PTZgPaGa98gASs2B4fMAtE=,tag:CL5hhRG16EvuLwhPq5bdKQ==,type:str]
+    pgp: []
+    encrypted_suffix: secret
+    version: 3.7.1
--- a/tests/stdlib/docker/run/passphrase/.dagger/env/default/values.yaml
+++ b/tests/stdlib/docker/run/passphrase/.dagger/env/default/values.yaml
@ -1,28 +0,0 @@
-name: default
-inputs:
-    key:
-        secret: ENC[AES256_GCM,data:OCiRUAarKcn5fK3jcAhV9xRS4AmpaXth6Bu8ozQ0dknyeM1ech2gzWMRfnBM1lIfcIxKAD/Dm7V4yJcj0sfGbgEsvpAslal6DYQ47lHDiGmDGDzu3dWAOqJpXwCCgsMagC/PoccsJPN4It0LyBW34dgBTB9NYC4fCX7ZpobLsw9Uf/JMAsxHp/nrUVhYDqHv2RXTV4zmdNIHjam+yFQLvSsSYdUOsEjx5DNMxmGM6Q9WuveqfM4sreetondvVzCVHBBB21dMO4WzJ2TwonobYvoSXxIVP/pHh0W3EIO46jLTvTv4NFAoyalFqTCf4ROPpsnFhCqLn10Iya1jn9h3QOrdsvA263zwv13bByPk+zOPRMJKfMN+VJMuKaT2a5zMVdhx35ULu9lEF6Xci7L1NEKIeRIfkyPHO5gSIdLVFGquU0qAasJ9rl7GDeTwyC9ejTJxOhbvPtmkq3ASFPkk7nC92IpOfjNVa3Y+hxxdmKKKJciSFcENGH0FvgbZo6gXft2dPpSiuwhbaxT42zJheOsLbTlgqzhJA8cHeT15kaOZNj/q0IkQStzo5P88EPdghNnEqq15szlKNS88gxbMIVuFpSFHDySBTHwOXXSmwrs=,iv:jNa+Pm4nOqAoQwa4b1auGvSYVPxNH3MQEagF5BKyyEs=,tag:vx8IUtpi9utnkzKSn/WTQw==,type:str]
-    passphrase:
-        secret: ENC[AES256_GCM,data:2pmIFddxYG8=,iv:Oty+wFlDEfzYcfXaJrhr6OOANP6o9gdD7fU0njEHloI=,tag:Ht4FJ0IZzQYazNcj1K0miw==,type:str]
-    user:
-        text: daggerci
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1gxwmtwahzwdmrskhf90ppwlnze30lgpm056kuesrxzeuyclrwvpsupwtpk
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXV3E3c3h4R0xKcnB5YUo5
-            eUdkeTZUbjZ4SU9VOTdEVzVPL296ZzRQMVNZCkMxblZKTXE0TDdhdy9PVk1sQ015
-            VWxxNjlLc2RMdUxFV3FrbVJMYk9KRzQKLS0tIHNGeXIvY3M5MTNHM05XTmNESkpZ
-            ZXAwa1h2aEhGRGpwVTJzKy9EZGhQb0kKSYnRAiRh7b2LViajHk46ct94PVLHDajC
-            oaUPwzy4bIMI9UXGobkstC5ObmY3ba+jcPRy6c9moniL+iigZ8YglA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2021-06-03T11:33:27Z"
-    mac: ENC[AES256_GCM,data:r3ngidgRewF0HqD3jI0PXeLTBsWw2HmDc1RP0Gtvo+vvgMqVbQEM/5Y/oI3tKDOqpS7iPXC49AHnNAO/NouYk4grebz/Tksn4OjDmwE/TzRV/EmRnC6LrT3/Fwga6NlG4QkxdWop9i7Wc+ND3BoCTVnWYB3Zr8zwOMcQaiUOdjI=,iv:KSYagnxOYKwIYEZzkP61O+rO/u4q61duTUFUy1vARpw=,tag:vxvioVzcIgVRtqLBHGvMfA==,type:str]
-    pgp: []
-    encrypted_suffix: secret
-    version: 3.7.1
--- a/tests/stdlib/docker/run/simple/.dagger/env/default/plan/simple.cue
+++ b/tests/stdlib/docker/run/simple/.dagger/env/default/plan/simple.cue
@ -1,20 +0,0 @@
-package docker
-
-import (
-	"dagger.io/docker"
-	"dagger.io/dagger"
-)
-
-key: dagger.#Secret @dagger(input)
-
-TestRun: {
-	random: #Random & {}
-
-	run: docker.#Run & {
-		host:  "143.198.64.230"
-		ref:   "nginx:alpine"
-		user:  "root"
-		name:  "daggerci-test-simple-\(random.out)"
-		"key": key
-	}
-}
--- a/tests/stdlib/docker/run/simple/.dagger/env/default/values.yaml
+++ b/tests/stdlib/docker/run/simple/.dagger/env/default/values.yaml
@ -1,24 +0,0 @@
-name: default
-inputs:
-    key:
-        secret: ENC[AES256_GCM,data:LdStiF5uyUW82+PE0pH2FxY9REawCC12KkmzP4tg8+GY64AIjoxMERTphmCE/wviTYTRQmzY3UniTd63cEVZ40FhiC+bUr1OnYfLmD/eaU2Sq2dfDdr1B11Vi1tFiq1Bm/InM05OpbUhwVeTGWFmOUuSYJAVcWwAV40nH/nxHg5KJQnPlmIxbmo4xtTkjE8yBgh5YsQy6A1oRap1wq+1GSJDYKDF/4f1C+7KtuNYhz82E+7L9O+OE356pWrVE1ocq4wh9uMIfswKDC1yIz5zdxU+VMfFAqqxLwMpZGJDIaZv5V1PEq7kgfK5xha7N0X3ek6woADd01rrYBTXbTov0Zce4GLXshaLKXDsWgFO75td7dRcH44+mKj9FFJCcBfVzID90fH80Q0JaZTNoZp0EJmLmIZ4p/D9OfziCL+MlMfHJCiK4i69wHxiZWBL7N918fMzr2SJaSqUEyWCZfvytjqzNKH4PGG0k/tO+KUDzDTVwpXU57RCvJU8imp4OpLoevjwEfjZ/i1IjDM+YjuVyHrffCpq1mX1OwkD,iv:A+8vdkhdye6bJfI+QMNOvCDproRsCO6m1CA1I1J9jlg=,tag:ujDkawZMuBfv9FEsKYnJZw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1gxwmtwahzwdmrskhf90ppwlnze30lgpm056kuesrxzeuyclrwvpsupwtpk
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpamtuNHB6NjY5L3VNT3hl
-            TGlmVFFoZURJR1RmZEFvSGUyVFRaSWNnSUMwClJiaDVGZWJoeDBMY21jZTVlREdS
-            aWg0SjNWN3BrTXRneXJyZy80K1JRSFUKLS0tIFEwKzdkVkNPT2VHTmtiOEdDQlZa
-            cnh2eHU5TzFjVkNvTzUyczFBL0pwTDQK60+wrLmTaD3Ws5ZAXdqBkMjaVP7Iz69k
-            UrkqkMbaUlvvSKK7dB5MuTGEEN6A1viAGal9ZjDHlSobkNPuE24QEA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2021-06-03T10:42:54Z"
-    mac: ENC[AES256_GCM,data:KU9f8Pa1hP7E59lmdt4tEIL4XJ+wMFbA8zHc/pzKXYiW9ryL94rDiFOzpcVcEtrSTEYl7J9ObnF0aGISWIMwlctOyBYpTOTz1ornzgdQaQn+ETGclcpi9pDtKWRSd7CQ4NmvbL51FUR0WmDDfBqIIjIg3RBwcWGZBTUCEy6aJjo=,iv:ZfZAedZWylLLvh+7Kka/ceb8XzQ+V/XkmPYKvAc6hHY=,tag:ymzo+Tb9M64BBJQSTNZXVA==,type:str]
-    pgp: []
-    encrypted_suffix: secret
-    version: 3.7.1
--- a/tests/stdlib/docker/run/ssh-passphrase/.dagger/env/default/.gitignore
+++ b/tests/stdlib/docker/run/ssh-passphrase/.dagger/env/default/.gitignore
--- a/tests/stdlib/docker/run/ssh-passphrase/.dagger/env/default/plan/passphrase.cue
+++ b/tests/stdlib/docker/run/ssh-passphrase/.dagger/env/default/plan/passphrase.cue
@ -0,0 +1,29 @@
+package docker
+
+import (
+	"dagger.io/docker"
+	"dagger.io/dagger"
+)
+
+testConfig: {
+	host:       string         @dagger(input)
+	user:       string         @dagger(input)
+	key:        dagger.#Secret @dagger(input)
+	passphrase: dagger.#Secret @dagger(input)
+}
+
+TestRun: {
+	random: #Random & {}
+
+	run: docker.#Run & {
+		ref:  "hello-world"
+		name: "daggerci-test-simple-\(random.out)"
+
+		ssh: {
+			host:          testConfig.host
+			user:          testConfig.user
+			key:           testConfig.key
+			keyPassphrase: testConfig.passphrase
+		}
+	}
+}
--- a/tests/stdlib/docker/run/ssh-passphrase/.dagger/env/default/plan/random.cue
+++ b/tests/stdlib/docker/run/ssh-passphrase/.dagger/env/default/plan/random.cue
--- a/tests/stdlib/docker/run/ssh-passphrase/.dagger/env/default/values.yaml
+++ b/tests/stdlib/docker/run/ssh-passphrase/.dagger/env/default/values.yaml
@ -0,0 +1,30 @@
+name: default
+inputs:
+    testConfig.host:
+        text: 143.198.64.230
+    testConfig.key:
+        secret: ENC[AES256_GCM,data:TwRbVzpg2UZzS08ww1EOjY0opSFVFtUVnC0Rh4lUnNcCYneDCm4cgW/+7vuYbuS+Ebc+mhdyb0Tp9aU1ZX2QHLed0VGbjuqT+dARHsHtljN890mOd/0oorKHoYh57pFN+67J8qAkUURgwVT4XFQwXd0/EZrccBrfSC/3P90v9EzGH65fn18Esg63+EDONssa4Gp2ylHOirIXf+KQIG1VIC6Fm2P8AbmMfPp+OpzgfubT0FL6vLeqc5se2jkxVXcibH8d5E+HL3m6t3T5ffxKk1UZZZJygMnZp8b6q0trh/msWHl8iJeq35L05/2avrKS+nPFfqzfBZWJ2kLRuX5o1JmIQHadwfX2GwX11RLNB1Ddfbuws18vXEXfo/tO4NFIjJYRwzDmp5+M8iM56Fpk5sh+sXeEmkm5dyBUbNI60LOEncAEvN0wKVs1GStg2vMOgWrR+ouQNUNNPBnGkgnHTF1ZxtkBvnWlCLB0Hnzx+aOkzZggrTef/n2gRjFf2qW5RH6VCMV2mrTR9WF2qB2cgQQMkbiseCQVBuPexZ+Kaq3oea6jd9YP1wVdLrZH+yoecn2FNgG4KA4S1wgFqgBFQN7CprxEktaxM+CGiIfuIEU=,iv:Tw7F1cuYRrao7T1fT9TvURB9bVMXmhoAulEO3ruDU8w=,tag:RpbUyOrAOjqEgG6+630tUg==,type:str]
+    testConfig.passphrase:
+        secret: ENC[AES256_GCM,data:74PlEJExk1A=,iv:9Y+Ioq9yKTWNdVjbbTpp5rKty02G+vNg90YIuZ1YWTM=,tag:kS6o5fFpxy3ZzlpxDHowFw==,type:str]
+    testConfig.user:
+        text: daggerci
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1gxwmtwahzwdmrskhf90ppwlnze30lgpm056kuesrxzeuyclrwvpsupwtpk
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXV3E3c3h4R0xKcnB5YUo5
+            eUdkeTZUbjZ4SU9VOTdEVzVPL296ZzRQMVNZCkMxblZKTXE0TDdhdy9PVk1sQ015
+            VWxxNjlLc2RMdUxFV3FrbVJMYk9KRzQKLS0tIHNGeXIvY3M5MTNHM05XTmNESkpZ
+            ZXAwa1h2aEhGRGpwVTJzKy9EZGhQb0kKSYnRAiRh7b2LViajHk46ct94PVLHDajC
+            oaUPwzy4bIMI9UXGobkstC5ObmY3ba+jcPRy6c9moniL+iigZ8YglA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2021-06-05T00:30:44Z"
+    mac: ENC[AES256_GCM,data:t+m0L6QrA1bcp329M3N/GdRqQBQIdop5dOqKhO3ALc/hAtAhaYUw15rqpwahOO87WHWhlF/yg1ZlI9fZzV3NlA5iykMkZfEqWJRitpRbmlyekNNGHcRkko2FJSuQwWvoV89z9eFlPn/EKx2jKiffuOUjOHAHn1QeIBdWwXDGVHc=,iv:GcYlGO+A4tqm507WoLiJeJHYNjYpnzjlHwQwb8YjBUw=,tag:H4/KvdPPKKbp0VfX4nJLUw==,type:str]
+    pgp: []
+    encrypted_suffix: secret
+    version: 3.7.1
--- a/tests/stdlib/docker/run/ssh-wrong-passphrase/.dagger/env/default/.gitignore
+++ b/tests/stdlib/docker/run/ssh-wrong-passphrase/.dagger/env/default/.gitignore
--- a/tests/stdlib/docker/run/ssh-wrong-passphrase/.dagger/env/default/plan/random.cue
+++ b/tests/stdlib/docker/run/ssh-wrong-passphrase/.dagger/env/default/plan/random.cue
--- a/tests/stdlib/docker/run/ssh-wrong-passphrase/.dagger/env/default/plan/wrong-passphrase.cue
+++ b/tests/stdlib/docker/run/ssh-wrong-passphrase/.dagger/env/default/plan/wrong-passphrase.cue
@ -0,0 +1,29 @@
+package docker
+
+import (
+	"dagger.io/docker"
+	"dagger.io/dagger"
+)
+
+testConfig: {
+	host:       string         @dagger(input)
+	user:       string         @dagger(input)
+	key:        dagger.#Secret @dagger(input)
+	passphrase: dagger.#Secret @dagger(input)
+}
+
+TestRun: {
+	random: #Random & {}
+
+	run: docker.#Run & {
+		name: "daggerci-test-simple-\(random.out)"
+		ref:  "hello-world"
+
+		ssh: {
+			host:          testConfig.host
+			user:          testConfig.user
+			key:           testConfig.key
+			keyPassphrase: testConfig.passphrase
+		}
+	}
+}
--- a/tests/stdlib/docker/run/ssh-wrong-passphrase/.dagger/env/default/values.yaml
+++ b/tests/stdlib/docker/run/ssh-wrong-passphrase/.dagger/env/default/values.yaml
@ -0,0 +1,30 @@
+name: default
+inputs:
+    testConfig,passphrase:
+        secret: ENC[AES256_GCM,data:ukRUZqFisp4n,iv:jtYyTQjr/Clm9zmIhlYXnNwCzxf0CRSkSRKIrCz1lMo=,tag:7tvyL9Jb5AGuZnOv2VomsQ==,type:str]
+    testConfig.host:
+        text: 143.198.64.230
+    testConfig.key:
+        secret: ENC[AES256_GCM,data:LFULtfbYoKG0RU0J087XiY6Z+0KmMMa37xhlnjXHQZG7VhOJKRAGqK8X8A8Ir/dRDZVPrI1TzhVQV9bCIxRwp7T48XJHhybfNci4veQUfsCUywFfy1UxgkxfrdIIj2mTdHjS8tlV2z+mlKOplEPla9qa3aG967rzn+vkx+6JTCCDtU7lHLPiS9qA+T5Y//SmDiNXObXkCYXTcAyq06YLMMMT1mn/j2LlAVqMz+squetsGjcwOgbbOMD4PS6927neG4ZAG7S/1HDZwTM//De3ACMtiWo7p95qMt50H+WMYlEc0OFd7gqFSgtfmseknOhfM6dqDoCYzu/Vbr+J0shvaxu2xQKJm40HLSwMQY7UekNmfnfBFV7ChaJ2v5EmcUqYNAWj3ffS/WDMZXgrhCxaOkSExP+pN2D6aBMNp7SMfua1yDVLy4R5VqPmGMiAA3x5RWSJg7WoooKOxZlnVxSSIWyAUdXAgA0/VruBf7sXi60Ky9sAeBBX0q0mcQq/RxVkneXZPJH4s6fVyKfk5ZPHNz2Cn4jb5cZp8ZTzsEoarCp5guHP3mBpv0J0SB0fL5eceZ+IIeHLWRgIm1darptGfdZFtcBJwYBaHb0BuojkgzM=,iv:S079SlDrEOJhy1/2s2YMieKFNkztyQlSsWrRKNEzuF8=,tag:grOBgrq8j8TBOE/15MbCIA==,type:str]
+    testConfig.user:
+        text: daggerci
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1gxwmtwahzwdmrskhf90ppwlnze30lgpm056kuesrxzeuyclrwvpsupwtpk
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDWjNjVWhSUnNuS2xaWFR2
+            Tm12UFg3elE0MUhILzJ0TkppQzR1VzZiUUMwClBwbncrR2VYVmxlZ09OUk1qV2tE
+            dURUZG1QVGZLdWM5WFlIQkF2UFB1YkUKLS0tIGFkN1VCajdkcHJRUk1YODBaWDFF
+            cm02K1NEenRnL25zc3RtaXd6SlA0UXcKFq38uYqZWvSlTOaisnhnQ+Mhbcv+ZifE
+            Mdxhq5w+Cdj+XhwbZ8UnnRInckD3UKovxAHV3kTSdXf54/QKn5TLVw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2021-06-05T00:31:18Z"
+    mac: ENC[AES256_GCM,data:EMJ5H+DsZdJCak7tYMNyKDS93qe7O6xKRlJ6GH6Y7/Y5RExUicPrvbE9Xu+zFCQkE82httrKMOwGrt6Z3yyAHMRQvuImRjKUao2UXXaRIoh2sPM2n2VyXQX9tu6BFtCC4VscaIGS0eLNesZXeqcue1ECP+VpRhPN8/s/cZrWPnc=,iv:WqyeW8IqZjZPi8jNzCg81O8ZMgXudZavHBjFrUEt9bs=,tag:bV1zDyFNl5M2FD1v0ZlEpw==,type:str]
+    pgp: []
+    encrypted_suffix: secret
+    version: 3.7.1
--- a/tests/stdlib/docker/run/ssh/.dagger/env/default/.gitignore
+++ b/tests/stdlib/docker/run/ssh/.dagger/env/default/.gitignore
@ -0,0 +1,2 @@
+# dagger state
+state/**
--- a/tests/stdlib/docker/run/ssh/.dagger/env/default/plan/random.cue
+++ b/tests/stdlib/docker/run/ssh/.dagger/env/default/plan/random.cue
@ -0,0 +1,33 @@
+package docker
+
+import (
+	"strconv"
+
+	"dagger.io/alpine"
+	"dagger.io/dagger/op"
+)
+
+#Random: {
+	size: *12 | number
+
+	out: {
+		string
+
+		#up: [
+			op.#Load & {from: alpine.#Image},
+
+			op.#Exec & {
+				always: true
+				args: ["sh", "-c", #"""
+					tr -cd '[:alpha:]' < /dev/urandom | fold -w "$SIZE" | head -n 1 | tr '[A-Z]' '[a-z]' | tr -d '\n' > /rand
+					"""#,
+				]
+				env: SIZE: strconv.FormatInt(size, 10)
+			},
+
+			op.#Export & {
+				source: "/rand"
+			},
+		]
+	}
+}
--- a/tests/stdlib/docker/run/ssh/.dagger/env/default/plan/simple.cue
+++ b/tests/stdlib/docker/run/ssh/.dagger/env/default/plan/simple.cue
@ -0,0 +1,29 @@
+package docker
+
+import (
+	"dagger.io/docker"
+	"dagger.io/dagger"
+)
+
+testConfig: {
+	host: string         @dagger(input)
+	user: string         @dagger(input)
+	key:  dagger.#Secret @dagger(input)
+}
+
+key: dagger.#Secret @dagger(input)
+
+TestSSH: {
+	random: #Random & {}
+
+	run: docker.#Run & {
+		name: "daggerci-test-simple-\(random.out)"
+		ref:  "hello-world"
+
+		ssh: {
+			host: testConfig.host
+			user: testConfig.user
+			key:  testConfig.key
+		}
+	}
+}
--- a/tests/stdlib/docker/run/ssh/.dagger/env/default/values.yaml
+++ b/tests/stdlib/docker/run/ssh/.dagger/env/default/values.yaml
@ -0,0 +1,28 @@
+name: default
+inputs:
+    testConfig.host:
+        text: 143.198.64.230
+    testConfig.key:
+        secret: ENC[AES256_GCM,data:j5gDMbjy4UpUDlQmf1DM5isBq9eZRxf8D34nilpslhMYLVW7pwqWBIRawz2wZ6mDeOGLzauxIzNTXNUGD9/dFfUb3re2UsFUnhq+P309U2M8K4DCiW/fAMCDVBplIv61/Kw/1fs86HV4Zoj4tht0sUzmqZ6/KkphUjyOGqc/UszNuzJG1EkDNlnSlZWHi1mKzrfmU+Yjs09eukIl+YCHGUvy2XZ5WS1c8sciPxcG0VFL0jMkLO/M0lOqyPgzsO9H0YN0dLG39Yz8uZtk8nrclM+iqWTCOsHwHG908NL3TW9LBBzMxwVHXUE7mPurO3Jxp+2cL5ZVOtMeWEykDCsgA5WatGf3xDr0ne8IfzKj+wIEKVfInfEAmisFSpDpJ+TCY9BeVcBDgqvtgEaUAw3nWHJOZwtjh2zOnL6GM/jP5t44Hsb1OveyKoO+NYQZC0b6LswpwVmwlq2dNSYshvVI28EswjqBcnZwbc07iu1YT2C4RakLVyZZ7xrKU1KDjvehCUIGCoBcxUb1h7k0IpzHDWA57+SyokiuFLI0,iv:UjRRsca4c3XjXFMMf9CIlPqtlw9SIwUEMgQbjZqJYAg=,tag:foFh41+vnduu30+s2Q85DQ==,type:str]
+    testConfig.user:
+        text: root
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1gxwmtwahzwdmrskhf90ppwlnze30lgpm056kuesrxzeuyclrwvpsupwtpk
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpamtuNHB6NjY5L3VNT3hl
+            TGlmVFFoZURJR1RmZEFvSGUyVFRaSWNnSUMwClJiaDVGZWJoeDBMY21jZTVlREdS
+            aWg0SjNWN3BrTXRneXJyZy80K1JRSFUKLS0tIFEwKzdkVkNPT2VHTmtiOEdDQlZa
+            cnh2eHU5TzFjVkNvTzUyczFBL0pwTDQK60+wrLmTaD3Ws5ZAXdqBkMjaVP7Iz69k
+            UrkqkMbaUlvvSKK7dB5MuTGEEN6A1viAGal9ZjDHlSobkNPuE24QEA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2021-06-05T00:29:38Z"
+    mac: ENC[AES256_GCM,data:lH3Zp9nPB+rsozAbtzaN2Nt6Vd2yd9NbCaYltn7u5RNa33I4MtIkixRUTuFK9qeWH0dQ0+2ysJluSDwzra4k+9fjgCpbiOKdfC0xEukoxExXmq+uwsBBpB3RTzcYBSo8SlhmT4NAyP2abP5y50x0c8vBiVZp9WPfJZBeR9p0NsU=,iv:M3ohijr5Jv8fKdvh/T25to/s+EmmVXD8vGDfKeo6czs=,tag:t8Bht/+C7L9Peytd2iDoGg==,type:str]
+    pgp: []
+    encrypted_suffix: secret
+    version: 3.7.1
--- a/tests/stdlib/docker/run/wrong-passphrase/.dagger/env/default/plan/wrong-password.cue
+++ b/tests/stdlib/docker/run/wrong-passphrase/.dagger/env/default/plan/wrong-password.cue
@ -1,24 +0,0 @@
-package docker
-
-import (
-	"dagger.io/docker"
-	"dagger.io/dagger"
-)
-
-// Run with --input-file key=$HOME/.ssh/<your private server key>
-key:        dagger.#Secret @dagger(input)
-passphrase: dagger.#Secret @dagger(input)
-user:       string         @dagger(input)
-
-TestRun: {
-	random: #Random & {}
-
-	run: docker.#Run & {
-		host:         "143.198.64.230"
-		ref:          "nginx:alpine"
-		"user":       user
-		"passphrase": passphrase
-		name:         "daggerci-test-simple-\(random.out)"
-		"key":        key
-	}
-}
--- a/tests/stdlib/docker/run/wrong-passphrase/.dagger/env/default/values.yaml
+++ b/tests/stdlib/docker/run/wrong-passphrase/.dagger/env/default/values.yaml
@ -1,28 +0,0 @@
-name: default
-inputs:
-    key:
-        secret: ENC[AES256_GCM,data:YbMbZupCsh3LmLK3SmQ9xSnTTC36jtt0GcM5a25222KCLYPIDmrratE/4TpklMBgr/dcCrWQIT7SsiKEjzAuJX0S9a3gvMWEPqixK53d/5D9QkRubxGogPo+UXg9yOEHbKkpKn7veLD+fNPuoWAIzid7aRSx8P01ZHervzTMshJE9yUSdMJSJysgbQborBKD0yV98PAIRbK8OgBKfXSic/ecGX1scxn2HIp8mzKPrpOBMd7YD8z95gROtSveAbKA4yhv3AdtCFZCGFPHsmt+6+rf1dJ+XL9ysfafLtbm507Ms01eAcNtNKuIaT7rtGcDoi77/EAc6ENRAqajVXZnjdA78XYvsiuqsKfXRDkMsFiH/grSxe4AI/goaOZsz6ahS8PDV36cePSsW/9E5ZWWfI5FmWUuDYuBL+NjVKW9EHdP9ERFKdh5U0/i7R4DXYl2vtsUqP1j74YYx9Fbj9OsqSqTA4jIPAMc8G2O8pJx0gJ+vLXr7YxEzW9mp45JA/1SGGlW3L4YW/ENyh2Aoh6PdPJ0XacLWsevIq8kuJYgDrgFpz52dO3vlMHz93U+pdHtelEgaqLmXOVEdvbKimJLmPa0Fe+I2cDrH5THt3APbO0=,iv:fQXqwrVKP2rqdYdRkVWlKxaB0w/Lc+Uf5i42fsdXDW8=,tag:UgTlsBylDI8ZjaM/smF2hA==,type:str]
-    passphrase:
-        secret: ENC[AES256_GCM,data:OWA7EULEzMMs,iv:k2WX+BP0qxIPVH5TgT2r2Mg7PRpfTcm89rOdRi2srzc=,tag:AbSGUKMmXcm0RW8+Az3taw==,type:str]
-    user:
-        text: daggerci
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1gxwmtwahzwdmrskhf90ppwlnze30lgpm056kuesrxzeuyclrwvpsupwtpk
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDWjNjVWhSUnNuS2xaWFR2
-            Tm12UFg3elE0MUhILzJ0TkppQzR1VzZiUUMwClBwbncrR2VYVmxlZ09OUk1qV2tE
-            dURUZG1QVGZLdWM5WFlIQkF2UFB1YkUKLS0tIGFkN1VCajdkcHJRUk1YODBaWDFF
-            cm02K1NEenRnL25zc3RtaXd6SlA0UXcKFq38uYqZWvSlTOaisnhnQ+Mhbcv+ZifE
-            Mdxhq5w+Cdj+XhwbZ8UnnRInckD3UKovxAHV3kTSdXf54/QKn5TLVw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2021-06-03T11:42:23Z"
-    mac: ENC[AES256_GCM,data:FoRbtx3IwLsyVWlhG4+0P5gmYXygURRiHCCnWX9rfYmCtPyCV1GE0nGQg8nSuAVr1AMhEZ8dx0/WU6o/YHpEfZtTywB83RlL7WFFC4Tn9SVsgzpzA9XyB8TIYgGgzj859xn35iDV27jWnAmQEDL+cWKiOgghx8P4hhRoOurH/Qg=,iv:Cm0gX0UGzrWUnuMv2hKaVY9X92VLTUkv1+nDypYPd4o=,tag:bU8fTYrZMDQWFpscckYoPg==,type:str]
-    pgp: []
-    encrypted_suffix: secret
-    version: 3.7.1