Accessing Containers via SSH

This guide explains how to connect to your running container from a local terminal using a reverse SSH tunnel via the MPE proxy. This is an advanced workflow primarily useful for users who prefer local terminal emulators or specific IDE integrations (like VS Code Remote SSH).

Prerequisites

Before proceeding with this setup, you must have your persistence layer configured. This ensures your SSH keys and server configurations survive container restarts.

Required Setup:

  1. Persistent Identity: Follow the Identity and Access guide to ensure your .ssh directory is stored in persistent storage.

  2. Automation Engine: Ensure your .bashrc is configured via the Shell Automation guide so that your .ssh symlink is restored automatically on boot.

Additionally, you will need:

  • A Local SSH Key Pair: Generated on your laptop (e.g., via ssh-keygen).

  • Proxy Access: MPE users can take advantage of our proxy server (login1.mpe.mpg.de). Non-MPE users can use any other equivalent proxy. Adjust the instructions below accordingly.

Setup and Connectivity

1. One-Time SSH Server Configuration

You need to set up the container to act as an SSH server. Since you have already set up persistent storage, we will put these files where they will survive restarts.

Generate the host key:

[!IMPORTANT] This is a Host Key, which allows the container to act as an SSH server. It is different from your Identity Key (described in Identity and Access), which you use to authenticate with GitHub or GitLab. You need both for full remote access.

# Generate the host key for the container's SSH server in your persistent folder
ssh-keygen -t ed25519 -f ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/ssh_host_key -N ""

Configure the SSH Daemon: Create a file at ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/sshd_config with the following content:

Port 2222
HostKey ~/.ssh/ssh_host_key
PidFile ~/.ssh/sshd.pid
StrictModes no
AuthorizedKeysFile ~/.ssh/authorized_keys

Note: StrictModes no is required because the .ssh directory is a symlink.

Add your Laptop’s Public Key: Paste your laptop’s public key (e.g., from ~/.ssh/id_ed25519.pub on your local machine) into the authorized_keys file inside your persistent .ssh folder:

# Ensure correct permissions
chmod 600 ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/authorized_keys

2. Activating SSH in a New Container

Once the one-time setup is done and your .bashrc is handling the symlinks, you only need to run these two steps when you start a new container:

Step A: Start the SSH server

/usr/sbin/sshd -D -e -f ~/.ssh/sshd_config

Step B: Create the reverse tunnel

In a separate terminal tab, map the container’s port to the MPE proxy:

ssh -N -R 2222:localhost:2222 <MPE_USERNAME>@login1.mpe.mpg.de

3. Connect from your laptop

Now, use the MPE proxy as a jump host to reach the container:

ssh -J <MPE_USERNAME>@login1.mpe.mpg.de -p 2222 idies@localhost