Skip to main content

​
Command: ssh

​
Syntax

phala ssh [options] [<cvm-name>] [--] [...]

​
Description

The phala ssh command connects you to a CVM via SSH through the secure gateway tunnel. It handles all the gateway configuration automatically. 
Usage: phala ssh [options] [<cvm-name>] [--] [...]

Connect to a CVM via SSH

Arguments:
  <cvm-name>?       CVM name. If not provided, reads from phala.toml

Options:
  -h, --help              Show help information
  -p, --port <value>      Gateway port (default: 443)
  -g, --gateway <value>   Gateway domain (skips API call for offline usage)
  -t, --timeout <value>   Connection timeout in seconds (default: 30)
  -v, --verbose           Show verbose connection details
  --dry-run               Print the SSH command without executing it

Pass-through (after --):
  All arguments after -- are passed directly to ssh.

​
Examples

  • Connect using phala.toml configuration
phala ssh
  • Connect to a specific CVM
phala ssh my-app
  • Preview the SSH command without connecting
phala ssh my-app --dry-run
  • Connect with verbose output for debugging
phala ssh my-app -v
  • Forward a local port to the CVM
phala ssh my-app -- -L 8080:localhost:80
This forwards your local port 8080 to port 80 on the CVM.
  • Set up a SOCKS proxy
phala ssh my-app -- -D 1080 -N
This creates a SOCKS proxy on local port 1080 without executing a remote command.
  • Execute a remote command
phala ssh my-app -- docker ps -a
  • Connect with a custom SSH key
phala ssh my-app -- -i ~/.ssh/custom_key
  • Offline mode (skip API lookup)
phala ssh my-app -g dstack-prod5.phala.network -p 443
When you specify the gateway domain, the CLI skips the API call and connects directly.

​
Pass-through Options

Any arguments after -- are passed directly to the underlying SSH command. Common options include:
OptionDescription
-i <keyfile>Use a specific identity file
-L <local>:<remote>Local port forwarding
-R <remote>:<local>Remote port forwarding
-D <port>Dynamic SOCKS proxy
-vSSH verbose mode
The -o ProxyCommand option is blocked since the CLI manages the proxy configuration automatically.