fix: use configured known_hosts path for SSH sandbox (#20114)

### What problem does this PR solve?

Use the configured SSH known_hosts path inside the Go sandbox container
when the SSH provider configuration does not specify one explicitly.

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)

docker/.env-go

@@ -423,8 +423,11 @@ DISABLE_PASSWORD_LOGIN=false
 # -----------------------------------------------------------------------------
 # Native Go MCP listener settings
 # -----------------------------------------------------------------------------
+RAGFLOW_SSH_KNOWN_HOSTS=${HOME}/.ssh/known_hosts
+SSH_KNOWN_HOSTS=/etc/ragflow/ssh_known_hosts
+
 # RAGFLOW_MCP_ENABLED=true
 # RAGFLOW_MCP_HOST=0.0.0.0
 # RAGFLOW_MCP_PORT=9382
 # RAGFLOW_MCP_LAUNCH_MODE=self-host
-# RAGFLOW_MCP_HOST_API_KEY=
+# RAGFLOW_MCP_HOST_API_KEY=

docker/docker-compose-go.yml

@@ -64,6 +64,7 @@ services:
       # - ./nginx/nginx.conf:/etc/nginx/nginx.conf
       - ./service_conf.yaml.template:/ragflow/conf/service_conf.yaml.template
       - ./entrypoint-go.sh:/ragflow/entrypoint.sh
+      - ${RAGFLOW_SSH_KNOWN_HOSTS:-${HOME}/.ssh/known_hosts}:${SSH_KNOWN_HOSTS:-/etc/ragflow/ssh_known_hosts}:ro
     env_file: .env-go
     # Route the Go services' cache/queue backend to the separate Kvrocks service.
     # The Python services use the Valkey `redis` service, which the Go deployment
@@ -114,6 +115,7 @@ services:
       # - ./nginx/nginx.conf:/etc/nginx/nginx.conf
       - ./service_conf.yaml.template:/ragflow/conf/service_conf.yaml.template
       - ./entrypoint-go.sh:/ragflow/entrypoint.sh
+      - ${RAGFLOW_SSH_KNOWN_HOSTS:-${HOME}/.ssh/known_hosts}:${SSH_KNOWN_HOSTS:-/etc/ragflow/ssh_known_hosts}:ro
     env_file: .env-go
     # Route the Go services' cache/queue backend to the separate Kvrocks service.
     # The Python services use the Valkey `redis` service, which the Go deployment

internal/agent/sandbox/ssh.go

@@ -513,12 +513,16 @@ func (p *SSHProvider) hostKeyCallback() (ssh.HostKeyCallback, error) {
 			files = append(files, file)
 		}
 	}
-	if p.knownHosts != "" {
-		files = append(files, p.knownHosts)
+	knownHosts := p.knownHosts
+	if knownHosts == "" {
+		knownHosts = common.GetEnv(common.EnvSSHKnownHosts)
+	}
+	if knownHosts != "" {
+		files = append(files, knownHosts)
 	}
 	callback, err := knownhosts.New(files...)
 	if err != nil {
-		return nil, fmt.Errorf("ssh: load known_hosts %q: %w", p.knownHosts, err)
+		return nil, fmt.Errorf("ssh: load known_hosts %q: %w", knownHosts, err)
 	}
 	return callback, nil
 }