# SSH access
<subtitle>Sandbox SSH via WebSocket proxy for remote terminal and file transfer. </subtitle>

SSH access can be used for remote terminal sessions, SCP/SFTP file transfers, and access to tools that require SSH connectivity.

## Quick start

### 1. Build SSH template

Define a template containing OpenSSH server and [websocat](https://github.com/vi/websocat):

```python
# template.py
from ucloud_sandbox import Template, wait_for_port

template = (
    Template()
    .from_ubuntu_image("25.04")
    .apt_install(["openssh-server"])
    .run_cmd([
        "curl -fsSL -o /usr/local/bin/websocat https://github.com/vi/websocat/releases/latest/download/websocat.x86_64-unknown-linux-musl",
        "chmod a+x /usr/local/bin/websocat",
    ], user="root")
    .set_start_cmd(
        "sudo websocat -b --exit-on-eof ws-l:0.0.0.0:8081 tcp:127.0.0.1:22",
        wait_for_port(8081),
    )
)
```

Build template:

```python
# build.py
from ucloud_sandbox import Template, default_build_logger
from template import template as ssh_template

Template.build(
    ssh_template,
    "ssh-ready",
    cpu_count=2,
    memory_mb=2048,
    on_build_logs=default_build_logger(),
)
```

### 2. Create a sandbox using a template

```python
from ucloud_sandbox import Sandbox

sbx = Sandbox.create("ssh-ready")
print(sbx.sandbox_id)
```

### 3. Connect to the sandbox from the local machine

macOS：

```bash
# Install websocat
brew install websocat

# Connect to the sandbox
ssh -o 'ProxyCommand=websocat --binary -B 65536 - wss://8081-%h.cn-wlcb.sandbox.ucloudai.com' user@<sandbox-id>
```

Linux：

```bash
# Install websocat
sudo curl -fsSL -o /usr/local/bin/websocat https://github.com/vi/websocat/releases/latest/download/websocat.x86_64-unknown-linux-musl
sudo chmod a+x /usr/local/bin/websocat

# Connect to the sandbox
ssh -o 'ProxyCommand=websocat --binary -B 65536 - wss://8081-%h.cn-wlcb.sandbox.ucloudai.com' user@<sandbox-id>
```

## Working principle

This method uses [websocat](https://github.com/vi/websocat) to proxy an SSH connection through a WebSocket to the port exposed by the sandbox.

```text
┌───────────────────────────────────────────────────────────┐
│ local machine │
│  ┌──────────┐    ProxyCommand    ┌──────────────────┐     │
│  │   SSH    │ ────────────────── │    websocat      │     │
│  │  Client  │                    │   (WebSocket)    │     │
│  └──────────┘                    └─────────┬────────┘     │
└────────────────────────────────────────────┼──────────────┘
                                             │
               wss://8081-<sandbox-id>.cn-wlcb.sandbox.ucloudai.com
                                             │
┌────────────────────────────────────────────┼──────────────┐
│  UCloud Sandbox                            ▼              │
│                                  ┌──────────────────┐     │
│                                  │    websocat      │     │
│                                  │  (WS → TCP:22)   │     │
│                                  └─────────┬────────┘     │
│                                            │              │
│                                  ┌─────────▼────────┐     │
│                                  │   SSH Server     │     │
│                                  │   (OpenSSH)      │     │
│                                  └──────────────────┘     │
└───────────────────────────────────────────────────────────┘
```