Connecting via SSH

Every pod is a full Linux system you can log into. SSH works the way you'd expect, with one twist: from the public internet you connect on a mapped external port, not the standard port 22.

Three things have to line up before a login works: the connection details, something to authenticate with, and a firewall that lets your address through. Each one has its own screen in the console, and every click is named below.

What you need first

• A pod that is Running.
• A way in: an SSH key attached to the pod, or the one-time login password. More on both just below.
• An IP address the pod's firewall allows. Step 2 covers that.

The cleanest path is to add an SSH key when you create the pod. The Create Pod page has an SSH Public Key (optional) field: paste a public key there, or pick one you have used before from the Select a saved SSH key dropdown. Pasted keys are saved for next time. Then you log in with your key and there is no password to manage at all.

If you don't add a key, an Ubuntu pod gets a generated login password instead. It is shown once, in the green toast that appears at the top right after you click Create Pod ("Auto-generated password: ..."), and never again. The toast clears itself after about five seconds, so hover over it to stop the clock while you copy. That password is also expired the moment it is created, so the first time you use it, SSH makes you set a new one before it gives you a prompt.

Instance pods can't reset their login password

There's no "reset password" for Ubuntu pods. If you lose the one-time password and never added a key, don't panic - use the browser Shell to get in (it doesn't need the password), then add your public key to the login user's authorized_keys. From then on you log in with the key. Reset password exists only for database pods (see below).

1. Find your connection details

1. Open Pods in the console, or click Pods in the side panel.
2. Click the pod's name in the table. You land on the pod's page, on the Overview tab.
3. Click the Connection Strings tab. An instance pod shows two cards, each holding a whole command:
   • Public SSH - ssh -p 3001 [email protected], for connecting from the internet. The external port is already in it.
   • Private SSH - ssh ubuntu@your-pod, for connecting from another pod on the same private network.
4. Click either card to copy the command it shows.

A MySQL pod gets Public MySQL and Private MySQL cards with a mysql command instead of the SSH ones.

Copying the whole line is the quick way. If you want the pieces one at a time, they are labelled on two other tabs of the same page:

Value	Where it is
Username - ubuntu on Ubuntu pods, root on database pods	Overview tab, Details card, the Username row
Public Host - what you connect to from the internet	Networking tab, Security & Public Access card
Ports - two numbers side by side, one marked private (the internal service port, 22 for SSH) and one marked public (the external port you pass to ssh -p)	Networking tab, Security & Public Access card
Hostname and Private IP - how pods on the same network reach this one	Networking tab, Private Network card

Click any of those values to copy it.

Pods in the same Region share one public host. The external port is the part that belongs to your pod alone, which is why -p is not optional.

2. Let your IP through the firewall

A pod created without picking a firewall gets one that blocks all public traffic. Your ssh will sit there until it times out, with no error worth reading, until your address is on the allow-list. (The in-browser Shell works regardless.)

1. On the pod's page, click the Networking tab.
2. In the Security & Public Access card, click the firewall's name in the Firewall row. You land on that firewall's page.
3. Click New Rule, at the top right. An Add Rule form opens above the rules.
4. Fill in IP Address / Network - 203.0.113.42/32 for a single address - and a Description you will still recognise in six months. Click Add.
5. Click Apply Changes, at the top right. Until you do, the rule only exists in your browser, and the header says Unsaved changes.

Rules take effect within seconds, no reboot.

3. Log in

Use the external port and public host from step 1:

ssh -p 3001 [email protected]

(Swap in the external port and public host shown on your pod.) Enter your key passphrase, or the login password if you're using one.

Adding an SSH key to an existing pod

If you didn't add a key at creation, add one now:

1. Get in once - over SSH with the login password, or through the browser Shell.
2. Append your public key to the login user's authorized_keys. Swap ubuntu below for the pod's Username from the Overview tab. The path is written out in full so the key lands in that user's home directory whichever user your session happens to be:

   sudo mkdir -p /home/ubuntu/.ssh
   echo "ssh-ed25519 AAAA... you@laptop" | sudo tee -a /home/ubuntu/.ssh/authorized_keys
   sudo chmod 700 /home/ubuntu/.ssh
   sudo chmod 600 /home/ubuntu/.ssh/authorized_keys
   sudo chown -R ubuntu:ubuntu /home/ubuntu/.ssh

3. From now on, ssh -p <external-port> ubuntu@<public-host> uses your key.

Connecting from another pod on the same network

When two pods share a private network, they reach each other directly on internal ports (no mapping) by private host. So from inside one pod, SSH to another is just:

ssh ubuntu@other-pod

other-pod is the Hostname shown on the other pod's Networking tab, in the Private Network card - the same value its Private SSH connection string uses. Port 22 is the default, so no -p here. Same goes for other services: MySQL on 3306, HTTP on 80, your app on 3000. Same-network neighbours use the real internal port.

Resetting a database password

Database pods only. If you lose a database pod's password:

1. Open Pods and click the database pod's name in the table.
2. Click the ... button at the top right of the pod's page.
3. Choose Reset password, then confirm in the dialog.

A fresh password is generated and shown once, in the toast that follows. Copy it there and then - it is not shown again. (Via the API: POST /api/pods/:id/reset-password.) On an Ubuntu pod the menu item isn't there at all.

Locking SSH down to your IP

You probably don't want SSH open to the world. See Networks and firewalls - a firewall that allows only your home or office IP closes every public port, SSH included, to everyone else. (Firewall rules are per-IP, not per-port.)

When SSH isn't an option

On a network that blocks outbound SSH? Use the browser Shell instead. It runs over the same connection as the console, so port mapping doesn't apply - it just works. (Ubuntu pods only.)