ssh + sftp + rsync in a networkless quadlet

Explanation

Systemd socket with Accept=no spawns the service and passes the listen socket to it, inside the container sshd is spawned and forks, then systemd-socket-proxyd starts proxying connections between the passed socket and the sshd listen port.

In theory debian's build of openssh-server is patched to work with systemd socket activation, which it does on normal debian systems, but I couldn't get it to work inside a container, despite the environment vars looking fine.

Usage

Create a file called "users" in which each line contains username and UID separate by space (see users.example). Ideally these are the same as on the host, so you get to keep the same file owner.

Create a directory for the users' data, edit the quadlet file to mount it under /home.

You probably want to persist the ssh keys across rebuilds, if so copy /etc/ssh to some host directory, then edit the quadlet file to mount it under /etc/ssh.

If you want to persist the SSH log, create the log file and edit the quadlet to mount it to /var/log/sshd.log.

Build the container, install the socket and container files as you do with quadlets (I run it rootful to keep uids consistent but you do you).

Caveats

Takes a couple seconds to start on first connection, takes a while to stop and does so with an error, either because of systemd-socket-proxyd not handling signals well or because of the multiple processes.