# Help with ssh forwarding with ansible-navigator on Mac

**URL:** <https://forum.ansible.com/t/help-with-ssh-forwarding-with-ansible-navigator-on-mac/44963>\
**Category:** Get Help\
**Tags:** ansible-navigator\
**Created:** [December 5, 2025, 8:45pm UTC](https://forum.ansible.com/t/help-with-ssh-forwarding-with-ansible-navigator-on-mac/44963 "2025-12-05T20:45:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jasmartin](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@jasmartin](https://forum.ansible.com/u/jasmartin)\
**Post date:** [December 5, 2025, 8:45pm UTC](https://forum.ansible.com/t/help-with-ssh-forwarding-with-ansible-navigator-on-mac/44963/1 "2025-12-05T20:45:31Z")

</div>

Hi all, I’m trying to get an ansible-navigator container to use my ssh keys on my Mac with Tahoe. I understand that it’s just supposed to work, and I know there’s issues with doing this on a Mac. I’ve tried to understand the various workarounds but I’m very new to containers and I’m not quite getting it. I’ve tried it both with Docker and Podman, and am still getting Permission denied (publickey) when attempting to run a playbook on a remote server. Does anyone have a tried-and-true method to make this work? Thanks!

---

<div class="post-metadata">

**Author:** ![dbrennand](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dbrennand/32/7830_2.png) [@dbrennand](https://forum.ansible.com/u/dbrennand)\
**Post date:** [December 6, 2025, 8:31pm UTC](https://forum.ansible.com/t/help-with-ssh-forwarding-with-ansible-navigator-on-mac/44963/2 "2025-12-06T20:31:20Z")

</div>

Hi @jasmartin

I’m using SSH agent forwarding with Ansible Navigator on MacOS. I’m using OrbStack which exposes the same SSH agent bind mount as Docker on Mac documented here: [How-tos | Docker Docs](https://docs.docker.com/desktop/features/networking/networking-how-tos/#ssh-agent-forwarding)

Then I use it in my ansible navigator config file under `container-options`: [home-ops/ansible/ansible-navigator.yml at main · dbrennand/home-ops · GitHub](https://github.com/dbrennand/home-ops/blob/main/ansible/ansible-navigator.yml)

Hope this helps! 🙂

---

<div class="post-metadata">

**Author:** ![jasmartin](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@jasmartin](https://forum.ansible.com/u/jasmartin)\
**Post date:** [December 8, 2025, 3:46pm UTC](https://forum.ansible.com/t/help-with-ssh-forwarding-with-ansible-navigator-on-mac/44963/3 "2025-12-08T15:46:24Z")

</div>

Thanks Daniel, I’m still running into problems.

What I did:

1. I copied your execution-environment.yml, requirements.txt, requirements.yml, and custom\_entrypoint.sh files into a test\_ee directory
2. I updated execution-environment.yml so the image is named “test\_ee” and the volume is my 1password agent.sock file.

```auto
---
ansible-navigator:
  execution-environment:
    container-engine: docker
    image: test_ee
    container-options:
      # SSH keys from 1Password are added to the SSH agent.
      # See: https://developer.1password.com/docs/ssh/agent/compatibility/#ssh-auth-sock
      # OrbStack creates the same path as Docker to bind the host's SSH agent socket into
      # the Execution Environment. See below links:
      # https://docs.docker.com/desktop/features/networking/#ssh-agent-forwarding
      # https://docs.orbstack.dev/docker/#ssh-agent-forwarding
      # This allows the Execution Environment to access the 1Password SSH agent socket.
      - "--volume=/Users/jasmartin/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock:/agent.sock"
    environment-variables:
      # We don't set the SSH_AUTH_SOCK to /agent.sock here because of observations seen in
      # https://github.com/ansible/ansible-navigator/issues/1591#issuecomment-2816701294
      # The variable precedence in this file is overridden by ansible-runner.
      # To workaround this issue, as we're already using a custom entrypoint script
      # (see ee/custom_entrypoint.sh), we override the SSH_AUTH_SOCK there instead.
      pass:
        # This environment variable is passed to the Execution Environment to authenticate
        # the op CLI. See ee/custom_entrypoint.sh for further details.
        - ONEPASSWORD_SERVICE_ACCOUNT_TOKEN

```

1. In the test\_ee directory, I ran: `ansible-builder build --tag test_ee --container-runtime docker`
2. I created a inventory/hosts.yaml with:

```auto
all:
  hosts:
    10.220.82.37

```

which is an IP I can ssh to with my key.

1. I made a test\_remote.yml playbook:

```auto
- name: Gather and print facts
  hosts: all
  become: true
  gather_facts: true
  tasks:

   - name: Print facts
     ansible.builtin.debug:
      var: ansible_facts

```

1. I run the playbook in the ee with:

```auto
ansible-navigator run test_remote.yml -i inventory --execution-environment-image test_ee --mode stdout --pull-policy missing --enable-prompts -K -u jasmartin --ce docker -vvvv --log-level debug

```

And still get:

```auto
[ERROR]: Task failed: Failed to connect to the host via ssh: Warning: Permanently added '10.220.82.37' (ED25519) to the list of known hosts.
jasmartin@10.220.82.37: Permission denied (publickey).

fatal: [10.220.82.37]: UNREACHABLE! => {
    "changed": false,
    "msg": "Task failed: Failed to connect to the host via ssh: Warning: Permanently added '10.220.82.37' (ED25519) to the list of known hosts.\r\njasmartin@10.220.82.37: Permission denied (publickey).",
    "unreachable": true
}

```

---

<div class="post-metadata">

**Author:** ![dbrennand](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dbrennand/32/7830_2.png) [@dbrennand](https://forum.ansible.com/u/dbrennand)\
**Post date:** [December 8, 2025, 4:28pm UTC](https://forum.ansible.com/t/help-with-ssh-forwarding-with-ansible-navigator-on-mac/44963/4 "2025-12-08T16:28:07Z")

</div>

Hi @jasmartin

You can remove the section:

```auto
    environment-variables:
      # We don't set the SSH_AUTH_SOCK to /agent.sock here because of observations seen in
      # https://github.com/ansible/ansible-navigator/issues/1591#issuecomment-2816701294
      # The variable precedence in this file is overridden by ansible-runner.
      # To workaround this issue, as we're already using a custom entrypoint script
      # (see ee/custom_entrypoint.sh), we override the SSH_AUTH_SOCK there instead.
      pass:
        # This environment variable is passed to the Execution Environment to authenticate
        # the op CLI. See ee/custom_entrypoint.sh for further details.
        - ONEPASSWORD_SERVICE_ACCOUNT_TOKEN

```

Unless you also want to use the [community.general.onepassword lookup – Fetch field values from 1Password — Ansible Community Documentation](https://docs.ansible.com/projects/ansible/latest/collections/community/general/onepassword_lookup.html) lookup plugin eventually.

I use zshell so in my `~/.zshrc` file I have the `SSH_AUTH_SOCK` environment variable exported as per instructions from [SSH client compatibility | 1Password Developer](https://developer.1password.com/docs/ssh/agent/compatibility/) :

```auto
export SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock

```

If you’re using bash then add it to your `~/.bashrc` file. Make sure to source the file afterwards.

If you’re using Docker on Mac, you will just need the same contents as what I had under `container-options`:

```auto
    container-options:
      - "--volume=/run/host-services/ssh-auth.sock:/agent.sock"

```

Now that I think of it, I don’t think I’ve ever tried it with `ansible-navigator run` - I always create a shell inside the EE and then run the playbook: `ansible-navigator exec -- /bin/bash`

> **[Home-Ops | AWX and Ansible Execution Environments](https://dbren.uk/blog/homeops-ansible-ee/#using-the-execution-environment)**
>
> Hey there folks! 👋
> Back again with another blog post! This time I wanted to discuss some cool changes I’ve made in my Homelab to explore AWX and Ansible Execution Environments.
> What is AWX? AWX provides a web interface and REST API for managing and...