Não consigo fazer um túnel SSH com sucesso dentro de um contêiner docker

Question

Até agora eu tive um servidor doméstico onde eu uso esta técnica acessá-lo fora de casa.

Mas agora eu tenho outro requisito, quero fazer isso de um contêiner docker dentro do meu servidor doméstico. Mas se eu tentar conectar-me ao túnel, recebo um erro de conexão recusada.

Então, para configurar algo assim, eu tenho um VPS online e meu servidor doméstico. Dentro do meu servidor doméstico, tenho um contêiner em execução. Troquei as chaves públicas entre o VPS e o contêiner, configurando adequadamente o arquivo authorized_keys um no outro. Confirmei que estou executando o contêiner com -p 22:22 e que nenhum serviço SSH está sendo executado fora do contêiner que poderia estar usando a porta 22 do host.

Em seguida, executo este comando no contêiner:

$ ssh -vvvfN -oStrictHostKeyChecking=no -R 20007:localhost:22 [email protected]

Então no meu VPS eu escrevo isto e a saída é seguida

$ ssh -vvv container_user@localhost -p 20007
OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "localhost" port 20009
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to localhost [127.0.0.1] port 20009.
debug1: Connection established.
debug1: identity file /home/raspi/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
ssh_exchange_identification: Connection closed by remote host

Agora, quando eu verificar os logs do contêiner, isso é o que eu vejo:

debug1: client_input_global_request: rtype [email protected] 
want_reply 0
debug1: remote forward success for: listen 20007, connect localhost:22
debug1: All remote forwarding requests processed
debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
debug1: client_request_forwarded_tcpip: listen localhost port 20007, originator 127.0.0.1 port 60364
debug2: fd 7 setting O_NONBLOCK
debug2: fd 7 setting TCP_NODELAY
debug1: connect_next: host localhost ([::1]:22) in progress, fd=7
debug3: fd 7 is O_NONBLOCK
debug3: fd 7 is O_NONBLOCK
debug1: channel 0: new [127.0.0.1]
debug1: confirm forwarded-tcpip
debug3: channel 0: waiting for connection
debug1: channel 0: connection failed: Connection refused
debug2: fd 8 setting O_NONBLOCK
debug2: fd 8 setting TCP_NODELAY
debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=8
debug3: channel 0: waiting for connection
debug1: channel 0: connection failed: Connection refused
connect_to localhost port 22: failed.
debug2: channel 0: zombie
debug2: channel 0: garbage collecting
debug1: channel 0: free: 127.0.0.1, nchannels 1
debug3: channel 0: status: The following connections are open:

Lembre-se de que todas essas etapas funcionam perfeitamente quando executadas fora de um contêiner, mas de alguma forma, dentro do contêiner, o VPS não pode fazer a conexão usando o túnel ...

EDITAR : Aqui está o código do contêiner que faz o túnel para o servidor remoto:

FROM ubuntu:16.04

RUN apt-get update && apt-get install -y ssh htop nano autossh
RUN ssh-keygen -f $HOME/.ssh/id_rsa -t rsa -N '';                                             \
COPY authorized_keys $HOME/.ssh/
echo '=======SAVE THIS KEY TO ~/.ssh/authorized_keys in the Cloud Server=======';             \
cat $HOME/.ssh/id_rsa.pub;                                                                    \
echo '=========================================================================';

RUN sleep 20 # Give me time to put the key in the cloud server

RUN echo "/usr/bin/ssh -vvvfN -oStrictHostKeyChecking=no -R 20009:localhost:22 [email protected]" > $HOME/connect.sh; \
chmod 777 $HOME/connect.sh

EXPOSE 22
EXPOSE 20009
CMD ["sh", "-c", "$HOME/connect.sh"]

This Dockerfile:

• generates a key pair,
• stores the pub key of the remote server,
• waits 20 secs for me to put that key pair in the remote server authorized_keys,
• and then opens the tunnel.

It doesn't work well as you can see for the error messages. But if I do these exact same steps in a physical machine instead of a container it just works fine...