---
title: "SSH Access"
description: "Connect to sandbox environments via SSH for direct inspection and debugging"
---

When a workflow runs in a [Daytona sandbox](/execution/environments#daytona), you can SSH into the sandbox to inspect files, run commands, and debug issues — all while the workflow is still executing.

<Note>
SSH access is only available with the Daytona sandbox provider. Local, Docker, and exe.dev sandboxes do not support SSH access.
</Note>

## Connecting to a run's sandbox

Use `fabro ssh` to connect to the Daytona sandbox from any completed or in-progress run:

```bash
fabro ssh <run-id>
```

Fabro creates temporary SSH credentials and connects directly. Use `--print` to print the SSH command instead of connecting, or `--ttl` to set the credential expiry:

```bash
fabro ssh <run-id> --print
fabro ssh <run-id> --ttl 120
```

## Enabling SSH access during `fabro run`

Pass the `--ssh` flag to `fabro run` to create SSH credentials at the start of the run:

```bash
fabro run workflow.fabro --sandbox daytona --ssh
```

After the sandbox is created, Fabro generates temporary SSH credentials (valid for 60 minutes) and prints the connection command:

```
  Sandbox: daytona (fabro-20260307-143022-a3f2)
             ssh daytona@fabro-20260307-143022-a3f2.ssh.daytona.io
```

Copy and run the `ssh` command in a separate terminal to connect.

## Keeping the sandbox alive

By default, Daytona sandboxes are destroyed when the workflow finishes. To keep the sandbox running after the workflow completes — so you can continue debugging — combine `--ssh` with `--preserve-sandbox`:

```bash
fabro run workflow.fabro --sandbox daytona --ssh --preserve-sandbox
```

Without `--preserve-sandbox`, the SSH session is terminated when the run ends and the sandbox is cleaned up.

You can also set `auto_stop_interval` in your run config to control how long an idle sandbox stays alive:

```toml title="run.toml"
[sandbox]
provider = "daytona"
preserve = true

[sandbox.daytona]
auto_stop_interval = 60
```

## What you can do over SSH

Once connected, you have a full shell inside the sandbox VM:

- **Inspect the working directory** — Agent file changes are at `/home/daytona/workspace`
- **Run commands** — Execute tests, check logs, inspect process state
- **Edit files** — Make manual fixes while the workflow is paused at a human gate
- **Debug failures** — Reproduce and diagnose issues in the exact environment where they occurred

## Credential lifetime

SSH credentials are temporary and expire after **60 minutes** by default. With `fabro ssh`, you can set a custom TTL with `--ttl <MINUTES>`. If your session expires, run `fabro ssh` again or start a new run with `--ssh` to get fresh credentials.

## Limitations

- SSH access is **Daytona-only**. Passing `--ssh` with other sandbox providers prints a warning and is ignored.
- SSH access is currently available only from the **CLI**. The API server and web UI do not yet expose an SSH endpoint.