Expose SSH on port 2222 and fix key-based auth with read-only mount

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: abendigo

docker-compose.yml

@@ -8,6 +8,7 @@ services:
       - workspace:/workspace
       - ssh-key:/home/claude/.ssh:ro
     ports:
+      - "2222:22"
       - "7681:7681"
     networks:
       - traefik_default

entrypoint.sh

@@ -4,6 +4,18 @@ set -e
 # Generate host SSH keys if not already present
 ssh-keygen -A
 
+# Copy mounted SSH keys to a writable location (mount is read-only)
+if [ -f /home/claude/.ssh/authorized_keys ]; then
+    cp /home/claude/.ssh/authorized_keys /tmp/authorized_keys
+    mkdir -p /home/claude/.ssh_writable
+    mv /tmp/authorized_keys /home/claude/.ssh_writable/authorized_keys
+    chmod 700 /home/claude/.ssh_writable
+    chmod 600 /home/claude/.ssh_writable/authorized_keys
+    chown -R claude:claude /home/claude/.ssh_writable
+    # Point sshd to the writable copy
+    echo "AuthorizedKeysFile /home/claude/.ssh_writable/authorized_keys" >> /etc/ssh/sshd_config
+fi
+
 # Start SSH daemon
 /usr/sbin/sshd