fix(bench): Pass build-relevant env into SSH sessions

[balamurali27]

echo $FRAPPE_HARD_LINK_ASSETS inside a bench over SSH comes back empty, even though the image sets it.

sshd builds a fresh environment for each session rather than inheriting its parent's. This config sets UsePAM no (so no /etc/environment) and PermitUserEnvironment no (so no ~/.ssh/environment), which leaves nothing to carry the image's ENV through. Result: a manual bench build over SSH symlinks assets, while the identical command via docker exec (agent's Rebuild Bench Assets) hard-links them.

Added a SetEnv line with the vars that are safe and meaningful in a shell session.

Two things worth knowing

SetEnv does not merge across lines. sshd keeps only the first one it reads — the "first obtained value wins" rule. Verified:

SetEnv A=1 / SetEnv B=2 / SetEnv C=3   ->  setenv A=1          (B and C silently dropped)
SetEnv A=1 B=2 C=3                     ->  setenv A=1 B=2 C=3

Hence the single long line. Anyone adding a var later must append to it, not add a line — the comment says so.

PATH is deliberately excluded. The image builds it as $PATH:/home/frappe/.nvm/versions/node/v${NODE_VERSION}/bin, and the node version isn't known to this static file. SSH sessions still won't find node/yarn — separate problem, not fixed here.

Config parses clean under sshd -T, and the trailing space in HISTTIMEFORMAT survives (it's inside the quotes).

Rollout

Bench.start() bind-mounts the host's config/ over the image's, and that host copy is seeded once at bench_init via docker run ... cp -LR config/. configmount. So this reaches new benches only — existing benches keep their baked-in sshd_config until they're recreated.

Related

Companion fix in press for the image-build side of the same symptom: frappe/press#7076

🤖 Generated with Claude Code

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request