> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anonalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH and VS Code Remote

> Plain OpenSSH into a sandbox: shells, scp, rsync, port forwarding and editors.

Every template that includes `base` has an OpenSSH server that starts on the first connection. You log in with a **certificate** that the Anona gateway signs for one sandbox and 10 minutes; there are no passwords and no long-lived keys to manage. The connection is carried over Anona's stream relay, so the sandbox needs no public port.

## With the CLI

`anona-compute ssh` makes a throwaway key, has it signed, and runs your system `ssh` through the relay:

```bash ssh.sh theme={null}
anona-compute ssh "$SANDBOX_ID" -- 'uname -a; id'
```

Everything after `--` goes to `ssh`: a remote command, or flags such as `-L 8080:localhost:8080` to forward a port. Interactive sessions work too: `anona-compute ssh $SANDBOX_ID`.

Copy files with `scp` semantics; sandbox paths start with a colon:

```bash scp_tree.sh theme={null}
mkdir -p out && echo hi > out/a.txt
anona-compute scp "$SANDBOX_ID" -- -r ./out :/home/user/
anona-compute ssh "$SANDBOX_ID" -- 'ls -R /home/user/out'
```

## ssh\_config for other tools

`--print-config` prints an `ssh_config` block with a fresh certificate, so `ssh`, `rsync` and editors can use `Host <sandbox id>` directly:

```bash ssh_config.sh theme={null}
anona-compute ssh "$SANDBOX_ID" --print-config > anona-sandbox.conf
ssh -F anona-sandbox.conf "$SANDBOX_ID" 'echo connected with plain ssh'
```

To use it from every tool, append it to `~/.ssh/config` instead: `anona-compute ssh <id> --print-config >> ~/.ssh/config`.

The certificate in the block expires after 10 minutes. Run `anona-compute ssh <id> --print-config` again (or any `anona-compute ssh`) to renew it; connections already open stay open.

### VS Code Remote-SSH

1. Install the Remote-SSH extension.
2. Run `anona-compute ssh <sandbox id> --print-config >> ~/.ssh/config`.
3. In VS Code, run **Remote-SSH: Connect to Host…** and pick the sandbox ID.

VS Code installs its server in `/home/user/.vscode-server` inside the sandbox, so the sandbox needs internet egress to download it. If you reconnect later than 10 minutes after step 2, repeat step 2 first. Editors that read `~/.ssh/config` (Cursor, JetBrains Gateway, Zed) take the same block.

> [!NOTE]
>
> The plain `ssh` connection above is part of the docs' automated checks; the editor flow itself has not been run in them yet.

## With the SDK

Sign your own key and write a config block, for tools that manage their own SSH:

```python ssh_sdk.py theme={null}
import os, pathlib, subprocess
from anona import Sandbox

key = pathlib.Path.home() / ".ssh" / "anona_ed25519"
key.parent.mkdir(exist_ok=True)
if not key.exists():
    subprocess.run(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", str(key)], check=True)

sbx = Sandbox.connect(os.environ["SANDBOX_ID"])
cert = sbx.ssh.certificate(f"{key}.pub")
cert.write(f"{key}-cert.pub")
print(cert.user, cert.host, cert.expires_at)
print(sbx.ssh.config(identity_file=str(key)))
```

```typescript ssh_sdk.ts theme={null}
import { execFileSync } from "node:child_process";
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
import { homedir } from "node:os";
import { Sandbox } from "@anona/sdk";

const key = `${homedir()}/.ssh/anona_ed25519`;
mkdirSync(`${homedir()}/.ssh`, { recursive: true });
if (!existsSync(key)) execFileSync("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-f", key]);

const sbx = await Sandbox.connect(process.env.SANDBOX_ID!);
const cert = await sbx.ssh.certificate(readFileSync(`${key}.pub`, "utf8"));
writeFileSync(`${key}-cert.pub`, cert.cert + "\n", { mode: 0o600 });
console.log(cert.user, cert.host, cert.expiresAt);
console.log(sbx.ssh.config({ identityFile: key }));
```

The block uses `ProxyCommand anona-compute ssh --proxy %h`, so the CLI must be on your `PATH` and signed in.

## Details

| | |
| - | - |
| Login user | `user` |
| Certificate | Ed25519 CA, valid 10 minutes, for one sandbox (principal `sbx:<id>`), allows a PTY and port forwarding |
| Who can get one | API keys with `sandboxes:use`, dashboard members and above |
| Host key | Generated in the sandbox; clients use `StrictHostKeyChecking accept-new`. **Coming soon:** host certificates |
| CA public key | `https://api.compute.anonalabs.com/.well-known/anona-ssh-user-ca.pub` |

Without SSH, `anona-compute connect <id>` opens a shell over the sandbox's own terminal API; see [Processes](https://docs.anonalabs.com/compute/guides/processes.md#terminals-pty).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.