solidify things; update readme

Author: bdevcich

ssh-container/Dockerfile

@@ -8,7 +8,6 @@ ARG USER_GID=1234
 ENV USER_UID=${USER_UID}
 ENV USER_GID=${USER_GID}
 
-# ENV USER="mpiuser"
 ENV SESSION_DIR="/home/mpiuser/ssh-session"
 ENV KEYS_DIR="/home/mpiuser/ssh-session/keys"
 
@@ -38,8 +37,7 @@ RUN cat ${KEYS_DIR}mpiuser_key.pub > ${KEYS_DIR}/authorized_keys
 # Override any entrypoint from base image and set our own
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod a+x /entrypoint.sh
-    
-# USER mpiuser
+
 WORKDIR /home/mpiuser
 
 # Configure SSH - port is set at runtime so we don't hardcode it here

ssh-container/Makefile

@@ -27,7 +27,7 @@ CONTAINER_TOOL ?= docker
 # Container name for easier management
 CONTAINER_NAME = ssh-container-$(UID)-$(GID)
 
-.PHONY: all docker-build clean ssh-keys client-keys run stop connect status help
+.PHONY: all docker-build clean ssh-keys client-keys keys run stop connect status help
 
 all: docker-build
 
@@ -59,8 +59,14 @@ client-keys: ## Generate SSH client keys for authentication
 		echo ""; \
 	fi
 
+# Generate both SSH host and client keys
+keys: ssh-keys client-keys ## Generate both SSH host and client keys
+	@echo "SSH keys generated successfully"
+	@echo "Host keys in: $(SSH_HOST_KEY_DIR)"
+	@echo "Client keys in: $(SSH_CLIENT_KEY_DIR)"
+
 # Build the container image
-docker-build: ssh-keys client-keys ## Build the container image with specified UID/GID
+docker-build:
 	@echo "Building $(CONTAINER_TOOL) image with UID=$(UID), GID=$(GID)..."
 	$(CONTAINER_TOOL) build \
 		--platform linux/amd64 \

ssh-container/README.md

@@ -4,46 +4,86 @@ This container provides SSH access to launcher containers running on Rabbit node
 
 ## Overview
 
-The SSH container enables remote access to Rabbit User Container workflows. It requires predetermined UID/GID and generated SSH keys baked into the image for secure authentication.
+The SSH container enables remote access to Rabbit User Container workflows. It requires predetermined UID/GID and
+generated SSH keys baked into the image for secure authentication. This means users will need to build their own image
+and publish it somewhere. 
 
-⚠️ **Security Note**: Images are user-specific and the generated keys must be kept secure - loss of keys means loss of access to the container.
+⚠️ **Security Note**: Images are user-specific and the generated keys must be kept secure - loss of keys means loss of
+access to the container.
 
-## Quick Start
+## Building and Publishing Your Image
+
+In this example, I use ghcr.io to publish the image publicly. Change this to an internal registry. This is using docker, but podman can be used.
 
 ```bash
 # 1. Generate SSH keys
-make ssh-keys client-keys
+make keys
 
 # 2. Build with your UID/GID  
-make build UID=1060 GID=100
+make build UID=1060 GID=100 # you can also change this in the Makefile
 
 # 3. Test locally
 make run
 make connect
 
 # 4. Publish to your registry
-docker tag ssh-container:latest your-registry.com/ssh-container:latest
-docker push your-registry.com/ssh-container:latest
+docker tag ssh-container:latest ghcr.io/bdevcich/ssh-container:latest
+docker push ghcr.io/bdevcich/ssh-container:latest
 ```
 
+The keys will be created and kept in `ssh_client_keys/`. The private key `mpiuser_key` is required to SSH into the
+container — **keep this file safe and secure; if you lose it, you will lose access to the container.**
+
+Only the private key (`mpiuser_key`) is needed on the compute node where you SSH from. The corresponding public key is
+already included in the container image.
+
 ## NNF Container Profile
 
-Create a profile referencing your published image:
-
-```yaml
-apiVersion: nnf.cray.hpe.com/v1alpha7
-kind: NnfContainerProfile
-metadata:
-  name: ssh-container-profile
-spec:
-  containers:
-  - name: ssh-launcher
-    image: your-registry.com/ssh-container:latest
-    ports:
-    - name: ssh
-      port: 22
+Edit the `NnfContainerProfile` to point to your image. An example is provided in this repo in `ssh-container.yaml`. Have
+an admin create a profile referencing your published image:
+
+```shell
+kubectl apply -f ssh-container.yaml
+```
+## Run 
+
+Once you have an image published and available to you via an `NnfContainerProfile`, you can use a flux allocation to
+start the containers and then jump to a compute node. As noted previously, you will need your private ssh key to get in.
+
+Start the allocation and use a `container` directive:
+
+```shell
+flux alloc -N4 --setattr=dw="#DW container name=ssh-container profile=ssh-container"
 ```
 
+Then, ssh into the container using the private key:
+
+```shell
+[blake@rabbit-compute-2 ~]$ ssh -i ./mpiuser_key -p $NNF_CONTAINER_PORTS mpiuser@$NNF_CONTAINER_LAUNCHER
+
+The programs included with the Debian GNU/Linux system are free software;
+the exact distribution terms for each program are described in the
+individual files in /usr/share/doc/*/copyright.
+
+Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
+permitted by applicable law.
+
+$ hostname
+fluxjob-321103304048246784-launcher
+$ whoami
+mpiuser$
+```
+
+Once inside the container, you can then run mpirun commands:
+
+```
+$ mpirun hostname
+fluxjob-321103304048246784-worker-0
+fluxjob-321103304048246784-worker-1
+```
+
+In this case, we have 2 workers on 2 rabbit nodes.
+
 ## Customization
 
 Add tools by modifying the Dockerfile:

ssh-container/ssh-container.yaml

@@ -0,0 +1,27 @@
+apiVersion: nnf.cray.hpe.com/v1alpha7
+kind: NnfContainerProfile
+metadata:
+  name: ssh-container
+  namespace: nnf-system
+data:
+  mpiSpec:
+    launcher:
+      containers:
+        - image: ghcr.io/bdevcich/ssh-container:latest
+          imagePullPolicy: IfNotPresent
+          name: ssh-svr
+    worker:
+      containers:
+        - image: ghcr.io/bdevcich/ssh-container:latest
+          imagePullPolicy: IfNotPresent
+          name: ssh-worker
+  numPorts: 1
+  pinned: false
+  postRunTimeoutSeconds: 0
+  preRunTimeoutSeconds: 300
+  retryLimit: 2
+  storages:
+    - name: DW_JOB_my_storage
+      optional: true
+    - name: DW_GLOBAL_lus
+      optional: true