Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions sandboxes/_data.ts
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@ export const sidebar = [
href: "/sandboxes/expose_http/",
},
{
title: "Expose SSH",
href: "/sandboxes/expose_ssh/",
title: "SSH",
href: "/sandboxes/ssh/",
},
{
title: "Manage Deploy apps",
Expand Down
49 changes: 31 additions & 18 deletions sandboxes/expose_ssh.md → sandboxes/ssh.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
---
title: "Expose SSH"
title: "SSH"
description: "How to open secure SSH access into a sandbox for interactive debugging, editor sessions, or long-running processes."
---

Sandboxes can hand out SSH credentials so you can inspect the filesystem, tail
logs, run editors, or forward ports while the microVM stays isolated on the
Deploy edge.
logs, run editors, or forward ports. SSH access is available both in your
terminal as a command and in the Deno Deploy Sandbox UI.

```tsx
import { Sandbox } from "@deno/sandbox";
Expand All @@ -24,18 +24,10 @@ script releases its references (for example, the `await using` block ends) the
sandbox shuts down and the SSH endpoint disappears; you can also call
`sandbox.kill()` if you need to tear it down immediately.

## When to use SSH access

- Debugging agent-generated code that only fails in the sandbox
- Editing files with a full-screen terminal editor or remote VS Code
- Streaming logs in real time without instrumenting application code
- Running profiling or inspection tools that are easier to use manually

Because each sandbox is already isolated, opening SSH does not compromise other
projects or organizations.

## Connecting from your machine

### exposeSsh method

1. Request credentials via `sandbox.exposeSsh()`.
2. Connect using the provided username and hostname:

Expand All @@ -46,13 +38,34 @@ ssh ${username}@${hostname}
3. Use regular terminal workflows: copy files, run top, tail logs, or attach to
running processes.

:::tip
## In the terminal

You can SSH into your sandbox from the terminal using the `--ssh` flag when
running your script:

```bash
deno sandbox create -ssh
```

## In the Deno Deploy console

After creating a sandbox, you can SSH into it in the Deno Deploy web app.

Tip: combine SSH with
[port forwarding](https://man.openbsd.org/ssh#LOCAL_FORWARDING) to view dev
servers that are bound to `localhost` inside the sandbox.
1. Log in to [console.deno.com](https://console.deno.com/) and navigate to the
"Sandboxes" section.
2. Either create a new sandbox or select an existing one from the list.
3. Click **Start SSH terminal** to open an interactive terminal session in your
browser.

:::
## When to use SSH access

- Debugging agent-generated code that only fails in the sandbox
- Editing files with a full-screen terminal editor or remote VS Code
- Streaming logs in real time without instrumenting application code
- Running profiling or inspection tools that are easier to use manually

Because each sandbox is already isolated, opening SSH does not compromise other
projects or organizations.

## Security considerations

Expand Down
4 changes: 2 additions & 2 deletions sandboxes/timeouts.md
Original file line number Diff line number Diff line change
Expand Up @@ -56,5 +56,5 @@ Coming soon.
provisioning.
- `Sandbox.connect({ id })` – resume control of a duration-based sandbox.
- `Sandbox.kill()` – terminate early.
- [`Expose HTTP`](./expose_http.md) and [`Expose SSH`](./expose_ssh.md) – note
that their URLs/credentials die with the sandbox lifetime.
- [`Expose HTTP`](./expose_http.md) and [`SSH`](./ssh.md) – note that their
URLs/credentials die with the sandbox lifetime.