M1 Mac Docker容器内npm i拉取GitHub私有仓库权限报错

问题现象 #

执行npm i时出现SSH权限拒绝错误：

npm ERR! An unknown git error occurred
npm ERR! command git --no-replace-objects ls-remote ssh://git@github.com/XXXXX/yyy-yyy.git
npm ERR! Warning: Permanently added 'github.com' (ED25519) to the list of known hosts.
npm ERR! git@github.com: Permission denied (publickey).
npm ERR! fatal: Could not read from remote repository.
npm ERR! 
npm ERR! Please make sure you have the correct access rights
npm ERR! and the repository exists.

容器内执行ssh -T git@github.com同样返回权限拒绝：

node@d4184eab93b1:~/app$ ssh -T git@github.com
The authenticity of host 'github.com (140.82.121.4)' can't be established.
ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'github.com' (ED25519) to the list of known hosts.
git@github.com: Permission denied (publickey).

当前配置：

docker-compose.yml #

version: '3.9'

services:
  api:
    container_name: api
    image: node:18.18
    working_dir: /home/node/app
    user: "1000:1000"
    volumes:
      - $PWD/:/home/node/app/
      - $PWD/.cache/npm:/root/.npm
      - $SSH_AUTH_SOCK:/ssh-agent
    expose:
      - "80"
    ports:
      - "9092:80"
    environment:
      NODE_ENV: dev
      GIT_SSH_COMMAND: ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no
      SSH_AUTH_SOCK: /ssh-agent
      DEBUG: 1
      GITHUB_TOKEN: $GITHUB_TOKEN
    command: npm run watch
    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 256M
        reservations:
          cpus: '0.25'
          memory: 128M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s

package.json依赖片段 #

"package-name": "github:XXXXX/package-name#v0.0.3",

.npmrc配置 #

engine-strict=true
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}
@XXXXX:registry=https://npm.pkg.github.com

解决方案 #

方案1：修正M1 Mac Docker的SSH代理路径与权限 #

M1 Mac的Docker Desktop使用统一的主机服务代理路径，需调整挂载配置：

• 修改docker-compose.yml中的volumes和环境变量：

  volumes:
    - $PWD/:/home/node/app/
    - $PWD/.cache/npm:/home/node/app/.npm  # 修正缓存路径，避免使用root目录
    - /run/host-services/ssh-auth.sock:/ssh-agent
  environment:
    SSH_AUTH_SOCK: /ssh-agent
    GIT_SSH_COMMAND: "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityAgent=$SSH_AUTH_SOCK"
  

• 主机端确认ssh-agent已加载密钥：

  # 检查密钥是否加载
  ssh-add -l
  # 若未加载，添加密钥（替换为你的私钥路径）
  ssh-add ~/.ssh/id_ed25519
  

• 确保Docker Desktop已开启SSH代理转发：进入Settings > Resources > File Sharing，确认/run/host-services在允许列表中（默认已开启）。

方案2：改用HTTPS协议拉取（绕开SSH认证） #

利用已有的GITHUB_TOKEN，将SSH依赖改为HTTPS格式：

• 直接修改package.json中的依赖：

  "package-name": "https://${GITHUB_TOKEN}@github.com/XXXXX/package-name.git#v0.0.3",
  

• 或全局配置Git自动替换SSH为HTTPS：
  在docker-compose的command中添加Git配置命令：

  command: sh -c 'git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "ssh://git@github.com/" && npm run watch'
  

  此配置会让所有ssh://git@github.com/开头的Git请求自动转为HTTPS并带上token认证。

方案3：调整容器用户权限 #

当前容器使用user:1000:1000，可能无法访问SSH代理socket，可临时调整：

• 启动时赋予socket全局访问权限（仅适用于开发环境）：

  command: sh -c 'chmod 666 /ssh-agent && npm run watch'
  

• 或临时切换为root用户执行npm install，再切回普通用户：

  command: sh -c 'su - root -c "npm i" && npm run watch'
  

方案4：验证GITHUB_TOKEN的仓库权限 #

确认你的GITHUB_TOKEN拥有目标私有仓库的read权限：

• 进入GitHub的Settings > Developer settings > Personal access tokens，检查token的repo权限是否开启。
• 测试token有效性：在主机执行curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/XXXXX/package-name，若返回仓库信息则权限正常。

内容的提问来源于stack exchange，提问作者shiqo