OpenSSH Server

services:
  openssh-server:
    image: "ghcr.io/daemonless/openssh-server:latest"
    container_name: openssh-server
    environment:
      - PUID=1000  # User ID of the login user
      - PGID=1000  # Group ID of the login user
      - TZ=UTC  # Timezone for the container
      - USER_NAME=bsd  # Login user name (default: bsd)
      - PUBLIC_KEY=ssh-ed25519 AAAA... you@example  # A public key added to authorized_keys
      - PASSWORD_ACCESS=false  # true allows password login (default: false, keys only)
      - SUDO_ACCESS=false  # true gives the user sudo (with password if one is set)
      # - PUBLIC_KEY_FILE=  # A file of public keys to add (works with secrets)
      # - PUBLIC_KEY_DIR=  # A directory of public key files to add
      # - PUBLIC_KEY_URL=  # A URL of public keys to add (e.g. https://github.com/<user>.keys)
      # - USER_PASSWORD=  # The user's password (random if unset)
      # - USER_PASSWORD_FILE=  # A file holding the password; wins over USER_PASSWORD
      # - LISTEN_PORT=  # Port sshd listens on (default: 2222)
      # - UMASK=  # umask for SFTP uploads (default: 022)
    volumes:
      - "/containers/openssh-server:/config"
    ports:
      - "2222:2222"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

# .env

DIRECTOR_PROJECT=openssh-server
PUID=1000
PGID=1000
TZ=UTC
USER_NAME=bsd
PUBLIC_KEY=ssh-ed25519 AAAA... you@example
PASSWORD_ACCESS=false
SUDO_ACCESS=false

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  openssh-server:
    name: openssh_server
    options:
      - container: 'args:--pull'
      - expose: '2222:2222 proto:tcp'
    oci:
      user: root
      environment:
        - PUID: !ENV '${PUID}'
        - PGID: !ENV '${PGID}'
        - TZ: !ENV '${TZ}'
        - USER_NAME: !ENV '${USER_NAME}'
        - PUBLIC_KEY: !ENV '${PUBLIC_KEY}'
        - PASSWORD_ACCESS: !ENV '${PASSWORD_ACCESS}'
        - SUDO_ACCESS: !ENV '${SUDO_ACCESS}'
    volumes:
      - OPENSSH_SERVER_CONFIG_PATH: /config
volumes:
  OPENSSH_SERVER_CONFIG_PATH:
    device: '/containers/openssh-server'

# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/openssh-server:${tag}

services:
  openssh-server:
    name: openssh-server
    image: "ghcr.io/daemonless/openssh-server:latest"
    network:
      - mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=UTC
      - USER_NAME=bsd
      - PUBLIC_KEY=ssh-ed25519 AAAA... you@example
      - PASSWORD_ACCESS=false
      - SUDO_ACCESS=false
    volumes:
      - "/containers/openssh-server:/config"