SSH access

tektona ssh opens an interactive shell in the sandbox, brokered through the platform: no public IP, no key management, no firewall changes.

Interactive shell

tektona ssh <sandbox-id>

The CLI launches your local ssh binary with the right host and short-lived access token. Exit with Ctrl-D or exit.

The shell lands in the image's WORKDIR if set (matching docker exec), otherwise in $HOME (matching a normal SSH login). tektona sandbox cp resolves relative remote paths against the same directory.

Run a single command

Anything after -- becomes the remote command:

tektona ssh <sandbox-id> -- whoami
tektona ssh <sandbox-id> -- cat /etc/os-release
tektona ssh <sandbox-id> -- bash -lc 'cd repo && pnpm test'

Stdout and stderr stream live, and the exit code propagates.

Resuming a sleeping sandbox

If the sandbox is hibernated or suspended, tektona ssh resumes it for you and connects once it's running. While it wakes you'll see Resuming sandbox… — an animated spinner in an interactive terminal, or a plain one-line message when the output is piped or you're running a -- <command>. A slow resume is waited out (up to a few minutes); genuine SSH auth or host errors are surfaced as usual.

Print without connecting

To inspect or reuse the resolved ssh invocation (for example, to plug it into another tool), pass --print:

tektona ssh <sandbox-id> --print

The CLI prints the full ssh command and exits without connecting.

Port forwarding

Use tektona sandbox port-forward to tunnel TCP ports from your machine into a sandbox. It uses the same brokered connection as tektona ssh: no public IP, no key management, no firewall changes required.

For HTTP-only ports a shareable URL is usually simpler. See tektona sandbox preview.

File transfer over SFTP

Use tektona sandbox cp to upload and download files between your local machine and a sandbox. It uses a native Go SFTP client and does not require OpenSSH or openssh-sftp-server in the image. No public IP, no key management, no firewall changes required.

See tektona sandbox cp --help for the full reference.

Combine with sandbox create

Create a sandbox and SSH into it in one step:

tektona sandbox create --image ghcr.io/tektona-ai/desktop-x11:0.4.3 --egress-network-policy tektona/open --ssh

Same flag works for tektona sandbox fork --ssh.