mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-08-28 05:27:41 +00:00
35bd79a2ed
Update 47 MDX doc pages, OpenAPI spec, SVG diagram, language grammar, frontend demo data, marketing page, skills, and README to use .fabro extension. Add "fabro" to fileTypes in language grammars. Document stack.child_workflow alongside stack.child_dotfile. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
81 lines
2.9 KiB
Text
81 lines
2.9 KiB
Text
---
|
|
title: "SSH Access"
|
|
description: "Connect to sandbox environments via SSH for direct inspection and debugging"
|
|
---
|
|
|
|
When a workflow runs in a [Daytona sandbox](/execution/environments#daytona), you can SSH into the sandbox to inspect files, run commands, and debug issues — all while the workflow is still executing.
|
|
|
|
<Note>
|
|
SSH access is only available with the Daytona sandbox provider. Local, Docker, and exe.dev sandboxes do not support SSH access.
|
|
</Note>
|
|
|
|
## Connecting to a run's sandbox
|
|
|
|
Use `fabro ssh` to connect to the Daytona sandbox from any completed or in-progress run:
|
|
|
|
```bash
|
|
fabro ssh <run-id>
|
|
```
|
|
|
|
Fabro creates temporary SSH credentials and connects directly. Use `--print` to print the SSH command instead of connecting, or `--ttl` to set the credential expiry:
|
|
|
|
```bash
|
|
fabro ssh <run-id> --print
|
|
fabro ssh <run-id> --ttl 120
|
|
```
|
|
|
|
## Enabling SSH access during `fabro run`
|
|
|
|
Pass the `--ssh` flag to `fabro run` to create SSH credentials at the start of the run:
|
|
|
|
```bash
|
|
fabro run workflow.fabro --sandbox daytona --ssh
|
|
```
|
|
|
|
After the sandbox is created, Fabro generates temporary SSH credentials (valid for 60 minutes) and prints the connection command:
|
|
|
|
```
|
|
Sandbox: daytona (fabro-20260307-143022-a3f2)
|
|
ssh daytona@fabro-20260307-143022-a3f2.ssh.daytona.io
|
|
```
|
|
|
|
Copy and run the `ssh` command in a separate terminal to connect.
|
|
|
|
## Keeping the sandbox alive
|
|
|
|
By default, Daytona sandboxes are destroyed when the workflow finishes. To keep the sandbox running after the workflow completes — so you can continue debugging — combine `--ssh` with `--preserve-sandbox`:
|
|
|
|
```bash
|
|
fabro run workflow.fabro --sandbox daytona --ssh --preserve-sandbox
|
|
```
|
|
|
|
Without `--preserve-sandbox`, the SSH session is terminated when the run ends and the sandbox is cleaned up.
|
|
|
|
You can also set `auto_stop_interval` in your run config to control how long an idle sandbox stays alive:
|
|
|
|
```toml title="run.toml"
|
|
[sandbox]
|
|
provider = "daytona"
|
|
preserve = true
|
|
|
|
[sandbox.daytona]
|
|
auto_stop_interval = 60
|
|
```
|
|
|
|
## What you can do over SSH
|
|
|
|
Once connected, you have a full shell inside the sandbox VM:
|
|
|
|
- **Inspect the working directory** — Agent file changes are at `/home/daytona/workspace`
|
|
- **Run commands** — Execute tests, check logs, inspect process state
|
|
- **Edit files** — Make manual fixes while the workflow is paused at a human gate
|
|
- **Debug failures** — Reproduce and diagnose issues in the exact environment where they occurred
|
|
|
|
## Credential lifetime
|
|
|
|
SSH credentials are temporary and expire after **60 minutes** by default. With `fabro ssh`, you can set a custom TTL with `--ttl <MINUTES>`. If your session expires, run `fabro ssh` again or start a new run with `--ssh` to get fresh credentials.
|
|
|
|
## Limitations
|
|
|
|
- SSH access is **Daytona-only**. Passing `--ssh` with other sandbox providers prints a warning and is ignored.
|
|
- SSH access is currently available only from the **CLI**. The API server and web UI do not yet expose an SSH endpoint.
|