Using python private packages with ssh hangs publishing to function app

[mebibou]

I have a python function app that I want to publish to Azure Function app. Inside the requirements.txt, I am referencing a private repo, something like:

azure-functions==1.0.0b4
azure-functions-worker==1.0.0b4
azure-storage==0.36.0
grpcio==1.14.2
grpcio-tools==1.14.2
protobuf==3.7.0
six==1.12.0
git+ssh://git@<git-host>/<my-private-repo>.git

I am deploying the function app using travis, like it is described in the doc:

sudo: required

language: python
python:
  - '3.6'
node_js:
  - '8'

services:
  - docker

addons:
  ssh_known_hosts: "<git-host>"

before_install:
  - openssl aes-256-cbc -K $encrypted_xxx_key -iv $encrypted_xxx_iv -in deploy_key.enc -out deploy_key -d
  - eval "$(ssh-agent -s)"
  - chmod 600 ./deploy_key
  - echo -e "Host *\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
  - ssh-add ./deploy_key

  - echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ wheezy main" | sudo tee /etc/apt/sources.list.d/azure-cli.list
  - curl -L https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -
  - sudo apt-get install -y apt-transport-https
  - sudo apt-get update && sudo apt-get install -y azure-cli
  - npm i -g azure-functions-core-tools --unsafe-perm true

script:
  - az login --service-principal --username "$APP_ID" --password "$PASSWORD" --tenant "$TENANT_ID"
  - func azure functionapp publish <my-func> --build-native-deps

During the build process in travis, the install step is working fine:

curl -L https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -
OK
2.47s$ sudo apt-get install -y apt-transport-https
OK
19.35s$ sudo apt-get update && sudo apt-get install -y azure-cli
OK
9.13s$ npm i -g azure-functions-core-tools --unsafe-perm true
OK
23.08s$ pip install -r requirements.txt
Collecting git+ssh://git@<git-host>/<my-private-repo>.git (from -r requirements.txt (line 8))
  Cloning git+ssh://git@<git-host>/<my-private-repo>.git to /tmp/pip-bi7jim1v-build
Warning: Permanently added '[secure],40.68.1.77' (ECDSA) to the list of known hosts.
....

But when reaching the actual deployment part using the docker image, the build steps just hangs there:

Getting site publishing info...
Running 'docker pull mcr.microsoft.com/azure-functions/python:2.0.12410-python3.6-buildenv'............................done
Running 'docker run --rm -d mcr.microsoft.com/azure-functions/python:2.0.12410-python3.6-buildenv sleep infinity'..done
Running 'docker cp "requirements.txt" 50d0e1:"/requirements.txt"'..done
Running 'docker cp "/tmp/tmpwpyCw1.tmp" 50d0e1:"python_docker_build.sh"'..done
Running 'docker exec -t 50d0e1 chmod +x /python_docker_build.sh'..done
Running 'docker exec -t 50d0e1 /python_docker_build.sh'........................................................................................................................................................................................................................................................................................................................................................................................................
The job exceeded the maximum time limit for jobs, and has been terminated.

Is it because the docker container does not have the ssh key to clone the private repo and is also trying to run pip install -r requirements.txt ? is there any way to give arguments to the docker container ? like giving -v ${PWD}/.ssh:/root/.ssh will be enough to pass the ssh key to the container

[ahmelsayed]

is there any way to give arguments to the docker container ? like giving -v ${PWD}/.ssh:/root/.ssh will be enough to pass the ssh key to the container

You can set

FUNCTIONS_PYTHON_DOCKER_IMAGE="<whatever args you want> mcr.microsoft.com/azure-functions/python:2.0.12410-python3.6-buildenv"

# For example

export FUNCTIONS_PYTHON_DOCKER_IMAGE="-v ${PWD}/.ssh:/root/.ssh mcr.microsoft.com/azure-functions/python:2.0.12410-python3.6-buildenv"

func azure functionapp publish <my-func> --build-native-deps

[mebibou]

@ahmelsayed doesn't work:

Getting site publishing info...
Running 'docker pull -v ~/.ssh:/root/.ssh mcr.microsoft.com/azure-functions/python:2.0.12410-python3.6-buildenv'..done
Error running docker pull -v ~/.ssh:/root/.ssh mcr.microsoft.com/azure-functions/python:2.0.12410-python3.6-buildenv.
output: 
unknown shorthand flag: 'v' in -v
See 'docker pull --help'.

[ahmelsayed]

sorry I forgot it's used there as well.

@ankitkumarr I think it would be good to add an env var that allows the user to take control of the run args for the docker image. also a way top skip the pull command as well. if the image is just local, the pull command will always fail.

I can't think of a workaround unfortunately.

[mebibou]

so I've tried with latest version of the azure-functions-core-tools but I am now having some bad permission issue:

Extensions command requires dotnet on your path. Please make sure to install dotnet (.NET Core SDK) for your system from https://www.microsoft.com/net/download
Getting site publishing info...
Running 'docker pull mcr.microsoft.com/azure-functions/python:2.0.12410-python3.6-buildenv'.................................................................................................................................................................................................................................................................................................................................................................................done
Running 'docker run --rm -v /home/travis/.ssh:/root/.ssh -d mcr.microsoft.com/azure-functions/python:2.0.12410-python3.6-buildenv sleep infinity'..done
Running 'docker exec -t bdf6e2 chmod +x /python_docker_build.sh'..done
Running 'docker exec -t bdf6e2 /python_docker_build.sh'..done
Running 'docker kill bdf6e2'..done
Error running docker exec -t bdf6e2638941786951d531931ea139d3c05ed87b3df366fce171d5b7dc7fbc60 /python_docker_build.sh.
output: Collecting git+ssh://git@<git-host>/<my-private-repo>.git (from -r /requirements.txt (line 8))
  Cloning ssh://git@<git-host>/<my-private-repo>.git to /tmp/pip-req-build-1dpabjm3

Bad owner or permissions on /root/.ssh/config

fatal: Could not read from remote repository.

anyone has an idea on how to fix this? I've tried to run chmod 755 on ~/.ssh/config before running the docker but it still says bad permission

[josiah14]

@mebibou SSH is complaining about the permissions on your /root/.ssh/ directory being too permissive. You should probably run, instead, chmod 700 on ~/.ssh and chmod -R 700 on ~/.ssh (to recursively restrict the permissions on the files themselves in ~/.ssh).