Pod GPU Crash dengan Exit 127: Bina Image Jupyter + SSH yang Tahan Override

/bin/bash: line 1: /usr/sbin/sshd: No such file or directory

FROM jupyter/minimal-notebook:aarch64-notebook-7.0.0

USER root

# OpenSSH server dipasang semasa build, bukan semasa runtime
RUN apt-get update -qq \
    && apt-get install -y -qq --no-install-recommends openssh-server \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

RUN mkdir -p /run/sshd /root/.ssh && chmod 700 /root/.ssh

COPY sshd_config /etc/ssh/sshd_config
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

EXPOSE 22 8888
USER root

# ENTRYPOINT = wrapper: sshd tetap bermula walaupun platform menimpa CMD
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
CMD ["/bin/bash", "-c", "jupyter lab --ip=0.0.0.0 --port=8888 --no-browser --allow-root --NotebookApp.token=\"${JUPYTER_TOKEN:?set JUPYTER_TOKEN}\""]

Port 22
PermitRootLogin yes
PasswordAuthentication yes
PubkeyAuthentication yes
KbdInteractiveAuthentication no
AuthorizedKeysFile .ssh/authorized_keys
UsePAM no

#!/bin/bash
set -e

# 1. Host key (boot pertama)
[ -f /etc/ssh/ssh_host_ed25519_key ] || ssh-keygen -A >/dev/null 2>&1 || true

# 2. Kata laluan daripada env
if [ -n "$SSH_PASSWORD" ]; then
  echo "root:$SSH_PASSWORD" | chpasswd
  echo "[ssh-init] OK root password set daripada env SSH_PASSWORD"
fi

# 3. Kunci awam daripada env (append; kunci lain tidak dipadam)
if [ -n "$SSH_PUBLIC_KEY" ]; then
  mkdir -p /root/.ssh && chmod 700 /root/.ssh
  echo "$SSH_PUBLIC_KEY" >> /root/.ssh/authorized_keys
  chmod 600 /root/.ssh/authorized_keys
  echo "[ssh-init] OK public key ditambah daripada env SSH_PUBLIC_KEY"
fi

# 4. Kunci awam daripada secret yang dimount
if [ -f /run/secrets/ssh-public-key ]; then
  mkdir -p /root/.ssh && chmod 700 /root/.ssh
  cat /run/secrets/ssh-public-key >> /root/.ssh/authorized_keys
  chmod 600 /root/.ssh/authorized_keys
  echo "[ssh-init] OK public key ditambah daripada /run/secrets/ssh-public-key"
fi

# 5. Fallback: tiada kata laluan dan tiada kunci → kata laluan rawak, cetak ke log
if [ -z "$SSH_PASSWORD" ] && [ ! -s /root/.ssh/authorized_keys ]; then
  GEN_PW=$(head -c 24 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 16)
  echo "root:$GEN_PW" | chpasswd
  echo "============================================================"
  echo "  [ssh-init] TIADA SSH_PASSWORD / SSH_PUBLIC_KEY ditetapkan"
  echo "  Kata laluan root sementara: $GEN_PW"
  echo "  Guna sekali sahaja, kemudian tetapkan kunci sendiri"
  echo "============================================================"
fi

# 6. Mulakan sshd; jika gagal, JANGAN bunuh pod (Jupyter tetap berjalan)
if /usr/sbin/sshd -p 22 >/dev/null 2>&1; then
  echo "[ssh-init] OK sshd bermula di port 22"
else
  echo "[ssh-init] WARNING: sshd gagal bermula, semak log" >&2
fi

# 7. Teruskan ke arahan sebenar (CMD image ATAU arahan override platform)
exec "$@"

ssh <gpu-node>
mkdir -p /tmp/gpu-image && cd /tmp/gpu-image
# letak Dockerfile, sshd_config dan docker-entrypoint.sh di sini
docker build -t jupyter-gpu-ssh:latest /tmp/gpu-image/

docker save jupyter-gpu-ssh:latest | gzip > /tmp/jupyter-gpu-ssh.tar.gz
gunzip -c /tmp/jupyter-gpu-ssh.tar.gz | ctr -n k8s.io images import -
crictl images | grep jupyter-gpu-ssh

env:
  - name: SSH_PUBLIC_KEY
    value: "ssh-ed25519 AAAAC3... user@laptop"
  - name: JUPYTER_TOKEN
    valueFrom:
      secretKeyRef: { name: jupyter-token, key: token }

volumeMounts:
  - name: ssh-key-secret
    mountPath: /run/secrets/ssh-public-key
    subPath: ssh-public-key
    readOnly: true

kubectl get pods -n <namespace> -w
kubectl logs -n <namespace> deployment/<name> -c <container>
# log mesti ada: [ssh-init] OK sshd bermula di port 22