Phala Cloud Documentation — Confidential AI on TEE

SSH works only on dev OS images. Select “dstack-dev” when you create your CVM. Production images have SSH turned off for security. You sign in with an SSH key. Passwords do not work.

The Phala CLI connects you through the secure gateway tunnel in one command.

Prerequisites

Phala CLI (latest version)
CVM deployed with Development OS

Step 1: Configure SSH Keys

Start by adding your SSH keys in Account Settings > SSH Keys on the Phala Cloud dashboard. You can add keys manually or sync them from GitHub. All saved keys are automatically added to every new CVM you deploy. When creating a CVM, the SSH Authorization section lets you add one more public key just for that CVM. It is added alongside your account keys. Your keys are copied into the CVM when it starts for the first time. Adding a key to your account later does not reach a CVM that is already running. To add a key to a running CVM, use Code Update and set the DSTACK_ROOT_PUBLIC_KEY environment variable. Since dstack 0.5.6, the SSH server rejects password logins. Only keys work. DSTACK_ROOT_PASSWORD still sets the Linux root password inside the CVM, but SSH will turn it down no matter what you set it to. Add a public key instead.

Step 2: Connect

# Connect using phala.toml configuration
phala ssh

# Or specify the CVM name directly
phala ssh my-cvm

That’s it. The CLI handles the gateway tunnel and SSH configuration automatically.

Useful Options

The phala ssh command supports several options:

# Preview the SSH command without connecting
phala ssh my-cvm --dry-run

# Enable verbose output for debugging
phala ssh my-cvm -v

# Forward a local port to the CVM
phala ssh my-cvm -- -L 8080:localhost:80

See the CLI reference for all options.

Manual SSH Configuration

If you prefer manual configuration or need to customize your setup, use phala ssh --dry-run to generate the SSH config:

phala ssh my-cvm --dry-run

This outputs a working SSH command you can adapt. The underlying mechanism uses OpenSSL to tunnel SSH through TLS:

Host my-cvm
    HostName <app-id>-22.<cluster>.phala.network
    User root
    Port 443
    ProxyCommand openssl s_client -quiet -connect %h:%p

Replace <app-id> with your application ID and <cluster> with your cluster (e.g., dstack-pha-prod7).macOS users: If you encounter connection timeouts, you may have LibreSSL instead of OpenSSL. Install OpenSSL via Homebrew and use the full path: /opt/homebrew/bin/openssl.Windows users: Install OpenSSL via Chocolatey (choco install openssl) and use the full path in ProxyCommand. Alternatively, use WSL where the Linux instructions work directly.

What You Can Do

Once connected, you have full access to debug and manage your CVM:

# Check containers
docker ps -a
docker logs <container-name>

# Monitor resources
htop
docker stats

# Debug networking
curl http://localhost:8080
netstat -tulpn

Remember to switch to a Production OS image when you’re done debugging.

Troubleshooting

Issue	Solution
Permission denied	Check that Account Settings has the key you are using. Passwords are rejected. For a running CVM, use Code Update to add a key.
Connection refused	Confirm you deployed with Development OS, not Production
Connection timeout	Run `phala ssh -v` to see detailed connection info

For more detailed troubleshooting, see Networking Troubleshooting.

​Prerequisites

​Step 1: Configure SSH Keys

​Why can’t I sign in with a password?

​Step 2: Connect

​Useful Options

​What You Can Do

​Troubleshooting

Prerequisites

Step 1: Configure SSH Keys

Why can’t I sign in with a password?

Step 2: Connect

Useful Options

What You Can Do

Troubleshooting