Skip to content

[Bug]: --ssh-identity Flag in dstack apply is Ignored #2317

Closed
Closed
[Bug]: --ssh-identity Flag in dstack apply is Ignored#2317
Labels
bugSomething isn't workingno-stale

Description

@movchan74
movchan74
opened on Feb 18, 2025

Steps to reproduce

  1. Run the following command to apply a deployment using a custom SSH identity file: 
    dstack apply -f app.dstack.yaml --ssh-identity ./id_rsa
  2. Observe that instead of using the specified SSH identity file (./id_rsa), dstack defaults to the user’s key at: 
    /home/aleksandr/.dstack/ssh/id_rsa
  3. This occurs even though --ssh-identity was explicitly provided in the command.

Actual behaviour

  • dstack apply ignores the --ssh-identity flag and continues using the default key at /home/aleksandr/.dstack/ssh/id_rsa.
  • Repo configuration does not contain the correct path to the SSH identity file.
  • This issue can be traced to repo_config, which does not correctly store the specified identity file.

Expected behaviour

  • The --ssh-identity flag should override the default key and use the specified SSH key (./id_rsa).
  • The correct SSH key should be passed to the run configuration, allowing for proper authentication.

dstack version

0.18.41

Server logs



Additional information


    

  • My goal is to use my own SSH key so I can connect from any other server or user using:

    dstack attach <run_name> --ssh-identity ./id_rsa
    

    • 

  • Since dstack apply does not set the correct SSH key, dstack attach does not work as expected when trying to connect from another server.
    • 

Activity
  1. movchan74
    added 
    bugSomething isn't working
     on Feb 18, 2025
  2. movchan74
    changed the title [-][Bug]: --ssh-identity` Flag in `dstack apply` is Ignored[/-] [+][Bug]: `--ssh-identity` Flag in `dstack apply` is Ignored[/+] on Feb 18, 2025
  3. jvstme commented on Mar 4, 2025 
    @jvstme
    jvstme
    on Mar 4, 2025
    Collaborator
    @movchan74, --ssh-identity is part of the repo options.
    

     
  Other repo options

    $ dstack apply --help
...

Repo Options:
  -P, --repo REPO       The repo to use for the run. Can be a local path or a Git repo URL.
  --repo-branch REPO_BRANCH
                        The repo branch to use for the run
  --repo-hash REPO_HASH
                        The hash of the repo commit to use for the run
  --no-repo             Do not use any repo for the run
  -t, --token OAUTH_TOKEN
                        An authentication token to access a private Git repo
  --git-identity SSH_PRIVATE_KEY
                        The private SSH key path to access a private Git repo
  --ssh-identity SSH_PRIVATE_KEY
                        The private SSH key path for SSH tunneling
  --local               Do not use Git
    

    

    Repo options are only respected if --repo is passed. They are a shorthand for initializing the repo without calling dstack init explicitly.
    

    So to set the SSH key, you can do this:
    

    $ dstack apply -f app.dstack.yaml --ssh-identity ./id_rsa --repo .
    

    Or this, which is equivalent:
    

    $ dstack init --ssh-identity ./id_rsa
$ dstack apply -f app.dstack.yaml 
  4. jvstme commented on Mar 4, 2025 
    @jvstme
    jvstme
    on Mar 4, 2025
    Collaborator
    But I agree that the behavior described in the issue is counterintuitive. Here is what we could do to improve it:
    

      

    • Prevent repo options from being ignored. Either:

        

      • show an error if any repo options are passed without --repo;
        • 

      • or assume --repo . if any repo options are passed.
        • 

      

      • 

    • Consider making --ssh-identity a run option rather than a repo option, so that it is possible to override the key for a run without associating that key with the repo.
      • 

  5. movchan74 commented on Mar 5, 2025 
    @movchan74
    movchan74
    on Mar 5, 2025
    Author
    @jvstme, thanks for the explanation. It is counterintuitive that the --ssh-identity option is tied to repo settings. The help text clearly indicates that it's for SSH tunneling, so having it only work when a repo is specified feels off.
    

    As you mentioned, making --ssh-identity a run option would allow us to override the SSH key for a run without binding it to a repo. I fully support moving it to run options or, at the very least, updating the documentation to clarify its intended behavior.
    

    Another point why it should be a run option. dstack attach also has --ssh-identity option, but it is definitely a run option.
  6. peterschmidt85 commented on Apr 3, 2025 
    @peterschmidt85
    peterschmidt85
    on Apr 3, 2025
    Contributor
    @jvstme Do we have an update on it?
  7. jvstme commented on Apr 3, 2025 
    @jvstme
    jvstme
    on Apr 3, 2025
    Collaborator
    @peterschmidt85, no. There is an explanation of how to achieve the desired behavior. The proposed UX improvements are in the backlog as part of this issue
  8. github-actions commented on Jun 9, 2025 
    @github-actions
    github-actionsBot
    on Jun 9, 2025 – with GitHub Actions
    This issue is stale because it has been open for 30 days with no activity.
  9. github-actions
    added 
    stale
     on Jun 9, 2025
  10. peterschmidt85
    added 
    no-stale
     and removed 
    stale
     on Jun 9, 2025
  11. un-def commented on Sep 3, 2025 
    @un-def
    un-def
    on Sep 3, 2025
    Collaborator
    Fixed via #3023 in 0.19.26
  12. un-def
    closed this as completedon Sep 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Metadata
Metadata
Assignees
No one assigned
    Labels
    bugSomething isn't workingno-stale
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions