From 4955788844c5a5bc3301c30e22d7ef864519e320 Mon Sep 17 00:00:00 2001
From: Matthew Westphall <westphall@wisc.edu>
Date: Tue, 21 Jul 2026 16:24:09 -0500
Subject: [PATCH 1/2] Add rrsync sidecar docker image

---
 contrib/rrsync/05-hostkeys.conf |  6 ++++++
 contrib/rrsync/10-rsync.conf    |  6 ++++++
 contrib/rrsync/Dockerfile       | 21 +++++++++++++++++++++
 contrib/rrsync/README.md        | 25 +++++++++++++++++++++++++
 contrib/rrsync/entrypoint.sh    | 12 ++++++++++++
 5 files changed, 70 insertions(+)
 create mode 100644 contrib/rrsync/05-hostkeys.conf
 create mode 100644 contrib/rrsync/10-rsync.conf
 create mode 100644 contrib/rrsync/Dockerfile
 create mode 100644 contrib/rrsync/README.md
 create mode 100644 contrib/rrsync/entrypoint.sh

diff --git a/contrib/rrsync/05-hostkeys.conf b/contrib/rrsync/05-hostkeys.conf
new file mode 100644
index 00000000..a60cdfa9
--- /dev/null
+++ b/contrib/rrsync/05-hostkeys.conf
@@ -0,0 +1,6 @@
+# Host keys are generated at container start (see entrypoint.sh) into a
+# dedicated directory rather than baked into the image or the default
+# /etc/ssh location.
+HostKey /etc/ssh/keys/ssh_host_rsa_key
+HostKey /etc/ssh/keys/ssh_host_ecdsa_key
+HostKey /etc/ssh/keys/ssh_host_ed25519_key
diff --git a/contrib/rrsync/10-rsync.conf b/contrib/rrsync/10-rsync.conf
new file mode 100644
index 00000000..9fee1bf8
--- /dev/null
+++ b/contrib/rrsync/10-rsync.conf
@@ -0,0 +1,6 @@
+# Restrict all SSH sessions to rsync-over-ssh; no interactive shell access.
+ForceCommand /usr/bin/rrsync /data
+PermitTTY no
+X11Forwarding no
+AllowTcpForwarding no
+AllowAgentForwarding no
diff --git a/contrib/rrsync/Dockerfile b/contrib/rrsync/Dockerfile
new file mode 100644
index 00000000..b7674e18
--- /dev/null
+++ b/contrib/rrsync/Dockerfile
@@ -0,0 +1,21 @@
+FROM almalinux:9
+
+LABEL maintainer="OSG Software <help@osg-htc.org>"
+
+RUN --mount=type=cache,id=dnf-9,target=/var/cache/dnf,sharing=locked \
+    dnf install -y openssh-server rsync-rrsync
+
+RUN mkdir /data
+
+RUN mkdir -p -m0755 /run/sshd && \
+    mkdir -p -m0700 /root/.ssh && \
+    mkdir -p -m0700 /etc/ssh/keys
+
+COPY --chown=root:root --chmod=0644 10-rsync.conf /etc/ssh/sshd_config.d/10-rsync.conf
+COPY --chown=root:root --chmod=0644 05-hostkeys.conf /etc/ssh/sshd_config.d/05-hostkeys.conf
+COPY --chown=root:root --chmod=0755 entrypoint.sh /entrypoint.sh
+
+CMD ["/entrypoint.sh"]
+
+EXPOSE 22/tcp
+VOLUME /data
diff --git a/contrib/rrsync/README.md b/contrib/rrsync/README.md
new file mode 100644
index 00000000..0b6cb000
--- /dev/null
+++ b/contrib/rrsync/README.md
@@ -0,0 +1,25 @@
+rsync-over-ssh sidecar
+======================
+
+Runs an sshd server intended to be deployed as a sidecar container in a
+Kubernetes Pod, allowing external clients to write to a shared volume via
+rsync over ssh.
+
+To permit login, volume-mount an `authorized_keys` file into
+`/root/.ssh/authorized_keys`.
+Mount the target data volume into `/data`.
+
+sshd is configured (see `10-rsync.conf`) to reject interactive shell
+access: every session is forced through [`rrsync`](https://download.samba.org/pub/rsync/rrsync.1).
+which restricts the client to rsync operations rooted at `/data` and
+rejects anything else.
+
+Example usage:
+
+```
+docker run --detach --name rsync-ssh \
+    -v ~/authorized_keys:/root/.ssh/authorized_keys \
+    -v ~/mydata:/data \
+    -p2222:22 rsync-ssh
+rsync -e "ssh -p 2222" myfile.txt root@localhost:/
+```
diff --git a/contrib/rrsync/entrypoint.sh b/contrib/rrsync/entrypoint.sh
new file mode 100644
index 00000000..10b1a0e7
--- /dev/null
+++ b/contrib/rrsync/entrypoint.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+KEY_DIR=/etc/ssh/keys
+
+if [ ! -f "$KEY_DIR/ssh_host_rsa_key" ]; then
+    for type in rsa ecdsa ed25519; do
+        ssh-keygen -q -t "$type" -f "$KEY_DIR/ssh_host_${type}_key" -N ''
+    done
+fi
+
+exec /usr/sbin/sshd -D -e

From 4341fac527e10e509dec2987a06b21e05f35ac06 Mon Sep 17 00:00:00 2001
From: mwestphall <westphall@wisc.edu>
Date: Wed, 5 Aug 2026 15:27:44 -0500
Subject: [PATCH 2/2] Apply suggestion from @matyasselmeci

Co-authored-by: Matyas Selmeci <mselmeci@wisc.edu>
---
 contrib/rrsync/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/contrib/rrsync/README.md b/contrib/rrsync/README.md
index 0b6cb000..0a0d614b 100644
--- a/contrib/rrsync/README.md
+++ b/contrib/rrsync/README.md
@@ -17,9 +17,9 @@ rejects anything else.
 Example usage:
 
 ```
-docker run --detach --name rsync-ssh \
+docker run --detach --name rrsync \
     -v ~/authorized_keys:/root/.ssh/authorized_keys \
     -v ~/mydata:/data \
-    -p2222:22 rsync-ssh
+    -p2222:22 rrsync
 rsync -e "ssh -p 2222" myfile.txt root@localhost:/
 ```