메뉴
Use when sharing a single `~/.ssh/config` across macOS + Linux - apply OpenSSH `IgnoreUnknown` to tolerate macOS-only directives (`UseKeychain`, `AddKeysToAgent`) on Linux where they would otherwise be fatal.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Prepare for a /clear: bring all documentation up to date with this session's changes, persist recovery context (memory + handoff), and emit a copy-paste resume prompt so the next session begins the next task with zero context loss. Invoke explicitly as /clear-prep [next-task].
Use when adding or modifying a devcontainer feature in devcontainer.json - fetch its devcontainer-feature.json schema first and verify every option key exists, because features silently drop unknown options.
Use when creating branches, commits, pushes, or PRs with plain git. Branch BEFORE committing — never commit directly onto the default branch. Avoids virtual-branch composition bugs where commits silently depend on other applied branches.
Write a CROSS-SURFACE session handoff to a tracked path and push it, so a session on another surface (web, desktop, or CLI) can continue with zero context loss. Use when ending a session whose work must be picked up on a DIFFERENT machine/surface. For same-machine /clear continuity use /clear-prep instead. Invoke as /handoff [next-task].
Use when running parallel-scientist research - ALWAYS follow with an opus verification stage that re-probes load-bearing claims and surfaces gaps. Skipping the verifier almost shipped a wrong recommendation in session 2026-04-07e.
Use when auditing whether the repo's pinned tools are current AND whether any hand-rolled custom code is now superseded by a native tool feature. Produces a retire/bump report from mise outdated + pkl/pin-vs-latest diff + a cache-first release-note scan.
| name | ssh-ignoreunknown-cross-platform |
| description | Use when sharing a single `~/.ssh/config` across macOS + Linux - apply OpenSSH `IgnoreUnknown` to tolerate macOS-only directives (`UseKeychain`, `AddKeysToAgent`) on Linux where they would otherwise be fatal. |
| type | learned-skill |
| extracted-from | session 2026-04-07e (devcontainer ssh debugging) |
| applicability | any time the host ~/.ssh/config is bind-mounted into a Linux container, or shared across platforms via dotfiles |
You bind-mount the host ~/.ssh/config into a Linux container. The
host ~/.ssh/config contains macOS-only directives:
Host github.com
AddKeysToAgent yes
UseKeychain yes # macOS-only
IdentityFile ~/.ssh/id_ed25519
Inside the Linux container, OpenSSH parses the file at startup and exits fatally:
/home/user/.ssh/config: line 14: Bad configuration option: usekeychain
/home/user/.ssh/config: terminating, 1 bad configuration options
The container can't ssh anywhere because the config never finishes parsing.
Editing the host ~/.ssh/config to remove UseKeychain — breaks the
macOS host's keychain integration.
Editing the container copy — can't, it's a readonly bind mount.
Maintaining two separate config files — drift between platforms, chezmoi or similar templating overhead.
IgnoreUnknownOpenSSH has a built-in directive for exactly this case:
IgnoreUnknown <pattern>. Any subsequent directive matching the
pattern is silently ignored instead of being a fatal parse error.
The directive must appear before the unknown options it covers,
since it only affects subsequent parses. The cleanest delivery is via
-o on the command line, which has the highest precedence and runs
before any file is read:
ssh -o "IgnoreUnknown=UseKeychain,AddKeysToAgent" -T git@github.com
On macOS, UseKeychain and AddKeysToAgent continue to work normally
(IgnoreUnknown doesn't disable known options, it only swallows unknown
ones). On Linux, they're silently dropped and ssh proceeds.
If you control the config file, you can prepend:
# Top of ~/.ssh/config — must come before any Host block
IgnoreUnknown UseKeychain,AddKeysToAgent
Host github.com
AddKeysToAgent yes
UseKeychain yes
IdentityFile ~/.ssh/id_ed25519
This keeps the file portable across platforms with zero per-host templating.
This is a special case of the "use the tool's built-in mechanism
before inventing custom logic" principle from
feedback_use_tool_builtins.md and .claude/rules/use-tool-builtins.md.
Before reaching for chezmoi templating, conditional file generation,
or platform-specific bind mounts, check if the tool has a built-in
escape hatch. OpenSSH has had IgnoreUnknown since version 4.4 (2006).
# Should exit 0 on both Linux and macOS
ssh -o "IgnoreUnknown=UseKeychain,AddKeysToAgent" -F ~/.ssh/config -G github.com >/dev/null && echo OK
-G (config dump) parses the file without connecting — fastest way
to verify the config is no longer fatal.
.agent/wiki/devcontainer-ssh-canonical-pattern.mdfeedback_use_tool_builtins.md (project memory)man ssh_config → IgnoreUnknown