> ## Documentation Index
> Fetch the complete documentation index at: https://docs.phala.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ssh

> Connect to a CVM via SSH

<Note>
  This command is marked as unstable and may change in future releases.
</Note>

### Command: `phala ssh`

#### Syntax

```
phala ssh [options] [<cvm_id>] [--] [...]
```

#### Description

Connect to a CVM via SSH

#### Arguments

| Argument    | Description                                           |
| ----------- | ----------------------------------------------------- |
| `<cvm_id>?` | CVM identifier (UUID, app\_id, instance\_id, or name) |

#### Options

| Option                  | Description                                       |
| ----------------------- | ------------------------------------------------- |
| `-p, --port <value>`    | Gateway port (priority: CLI > phala.toml > 443)   |
| `-g, --gateway <value>` | Gateway domain (priority: CLI > phala.toml > API) |
| `-t, --timeout <value>` | Connection timeout in seconds (default: 30)       |
| `-v, --verbose`         | Show verbose connection details                   |
| `--dry-run`             | Print SSH command without executing               |

#### Global Options

| Option                               | Description                                               |
| ------------------------------------ | --------------------------------------------------------- |
| `-h, --help`                         | Show help information for the current command             |
| `--version`                          | Show CLI version                                          |
| `--api-token TOKEN, --api-key TOKEN` | API token for authenticating with Phala Cloud             |
| `-j, --json, --no-json`              | Output in JSON format                                     |
| `-i, --interactive`                  | Enable interactive mode                                   |
| `--cvm-id <value>`                   | CVM identifier (UUID, app\_id, instance\_id, or name)     |
| `--profile PROFILE`                  | Temporarily use a different auth profile for this command |
| `--api-version <value>`              | API version to use (e.g. 2025-10-28, 2026-01-21)          |

#### Pass-through Arguments

All arguments after -- are passed directly to ssh. Common options: -i (identity file), -L (local forward), -R (remote forward), -D (SOCKS proxy), -N (no command), -v (ssh verbose). Any trailing arguments are executed as remote command. Note: -o ProxyCommand is blocked.

#### Examples

* Connect from phala.toml

```bash theme={"system"}
phala ssh
```

* Connect to CVM

```bash theme={"system"}
phala ssh app_123
```

* Offline mode

```bash theme={"system"}
phala ssh app_123 -g dstack-pha-prod7.phala.network -p 16185
```

* Connect with custom SSH key

```bash theme={"system"}
phala ssh app_123 -- -i ~/.ssh/custom_key
```

* Forward local port 8080 to remote port 80

```bash theme={"system"}
phala ssh app_123 -- -L 8080:localhost:80
```

* SOCKS proxy without remote command

```bash theme={"system"}
phala ssh app_123 -- -D 1080 -N
```

* Execute remote command

```bash theme={"system"}
phala ssh app_123 -- ls -la /app
```

* Connect with verbose output for debugging

```bash theme={"system"}
phala ssh app_123 -v
```

* Print the SSH command without executing

```bash theme={"system"}
phala ssh app_123 --dry-run -- -L 8080:localhost:80
```