Mount an individual file in Azure Container Instances?

Question

I'm attempting to mount a single file in an azure container instance, in this case the ssh host key file as described in this docker image: https://github.com/atmoz/sftp

However from my experiments Azure Container Instances via ARM / Azure CLI seem to only support mounting folders.

If I attempt to mount as a file I suspect it's actually mounting as a folder, as the built in bash appears to miss the fact it already exists, and then errors when it tries to write to it.

Are there any undocumented features to mount individual files? I'm hoping not needing to resorting customising the docker image, as it would defeat my objective of using a ready made image. :-(

Answer 1

You can mount files using Key Vault. If you are deploying your ACI container group using an ARM template, you can integrate it with an instance of Azure Key Vault. It is possible to mount a key vault "secret" as a single file within a directory of your choosing. Refer to the ACI ARM template reference for more details.

Answer 2

You can do it via Azure Container Instance secrets.
Either azure cli:

az container create \
--resource-group myResourceGroup \
--name secret-volume-demo \
--image mcr.microsoft.com/azuredocs/aci-helloworld \
--secrets id_rsa.pub="<file-content>" \
--secrets-mount-path /home/foo/.ssh/keys

or with terraform:

resource "azurerm_container_group" "aci_container" {
    name                = ""
    resource_group_name = ""
    location            = ""
    ip_address_type     = "public"
    dns_name_label      = "dns_endpoint"
    os_type             = "Linux"

    container {
        name   = "sftp"
        image  = "docker.io/atmoz/sftp:alpine-3.7"
        cpu    = "1"
        memory = "0.5"

        ports {
            port     = 22
            protocol = "TCP"
        }

        // option 1: mount key as Azure Container Instances secret volume
        volume {
            name       = "user-pub-key"
            mount_path = "/home/foo/.ssh/keys"
            secret = {
            "id_rsa.pub" = base64encode("<public-key-content>")
            }
        }

        // option 2: mount ssh public key as Azure File share volume
        // Note: This option will work for user keys to auth, but not for the host keys 
        // since atmoz/sftp logic is to change files permission, 
        // but Azure File share does not support this POSIX feature
        volume {
            name = "user-pub-key"     
            mount_path = "/home/foo/.ssh/keys"
            read_only = true
            share_name = "share-name"
            storage_account_name = "storage-account-name"
            storage_account_key  = "storage-account-key"
        }
}

In both cases, you will have a file /home/foo/.ssh/keys/id_rsa.pub with the given content.