SSH and VS Code Remote

Every template that includes base has an OpenSSH server that starts on the first connection. You log in with a certificate that the Anona gateway signs for one sandbox and 10 minutes; there are no passwords and no long-lived keys to manage. The connection is carried over Anona’s stream relay, so the sandbox needs no public port.

With the CLI

anona-compute ssh makes a throwaway key, has it signed, and runs your system ssh through the relay:

ssh.sh

anona-compute ssh "$SANDBOX_ID" -- 'uname -a; id'

Everything after -- goes to ssh: a remote command, or flags such as -L 8080:localhost:8080 to forward a port. Interactive sessions work too: anona-compute ssh $SANDBOX_ID. Copy files with scp semantics; sandbox paths start with a colon:

scp_tree.sh

mkdir -p out && echo hi > out/a.txt
anona-compute scp "$SANDBOX_ID" -- -r ./out :/home/user/
anona-compute ssh "$SANDBOX_ID" -- 'ls -R /home/user/out'

ssh_config for other tools

--print-config prints an ssh_config block with a fresh certificate, so ssh, rsync and editors can use Host <sandbox id> directly:

ssh_config.sh

anona-compute ssh "$SANDBOX_ID" --print-config > anona-sandbox.conf
ssh -F anona-sandbox.conf "$SANDBOX_ID" 'echo connected with plain ssh'

To use it from every tool, append it to ~/.ssh/config instead: anona-compute ssh <id> --print-config >> ~/.ssh/config. The certificate in the block expires after 10 minutes. Run anona-compute ssh <id> --print-config again (or any anona-compute ssh) to renew it; connections already open stay open.

VS Code Remote-SSH

Install the Remote-SSH extension.
Run anona-compute ssh <sandbox id> --print-config >> ~/.ssh/config.
In VS Code, run Remote-SSH: Connect to Host… and pick the sandbox ID.

VS Code installs its server in /home/user/.vscode-server inside the sandbox, so the sandbox needs internet egress to download it. If you reconnect later than 10 minutes after step 2, repeat step 2 first. Editors that read ~/.ssh/config (Cursor, JetBrains Gateway, Zed) take the same block.

The plain ssh connection above is part of the docs’ automated checks; the editor flow itself has not been run in them yet.

With the SDK

Sign your own key and write a config block, for tools that manage their own SSH:

import os, pathlib, subprocess
from anona import Sandbox

key = pathlib.Path.home() / ".ssh" / "anona_ed25519"
key.parent.mkdir(exist_ok=True)
if not key.exists():
    subprocess.run(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", str(key)], check=True)

sbx = Sandbox.connect(os.environ["SANDBOX_ID"])
cert = sbx.ssh.certificate(f"{key}.pub")
cert.write(f"{key}-cert.pub")
print(cert.user, cert.host, cert.expires_at)
print(sbx.ssh.config(identity_file=str(key)))

import { execFileSync } from "node:child_process";
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
import { homedir } from "node:os";
import { Sandbox } from "@anona/sdk";

const key = `${homedir()}/.ssh/anona_ed25519`;
mkdirSync(`${homedir()}/.ssh`, { recursive: true });
if (!existsSync(key)) execFileSync("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-f", key]);

const sbx = await Sandbox.connect(process.env.SANDBOX_ID!);
const cert = await sbx.ssh.certificate(readFileSync(`${key}.pub`, "utf8"));
writeFileSync(`${key}-cert.pub`, cert.cert + "\n", { mode: 0o600 });
console.log(cert.user, cert.host, cert.expiresAt);
console.log(sbx.ssh.config({ identityFile: key }));

The block uses ProxyCommand anona-compute ssh --proxy %h, so the CLI must be on your PATH and signed in.

Details


Login user	`user`
Certificate	Ed25519 CA, valid 10 minutes, for one sandbox (principal `sbx:<id>`), allows a PTY and port forwarding
Who can get one	API keys with `sandboxes:use`, dashboard members and above
Host key	Generated in the sandbox; clients use `StrictHostKeyChecking accept-new`. Coming soon: host certificates
CA public key	`https://api.compute.anonalabs.com/.well-known/anona-ssh-user-ca.pub`

Without SSH, anona-compute connect <id> opens a shell over the sandbox’s own terminal API; see Processes.

Get started

Agent onboarding

Concepts

Guides

Recipes

CLI

SDKs

API reference

Sandboxes and templates (E2B)

Anona

Account

Help

With the CLI

ssh_config for other tools

VS Code Remote-SSH

With the SDK

Details

​With the CLI

​ssh_config for other tools

​VS Code Remote-SSH

​With the SDK

​Details

With the CLI

ssh_config for other tools

VS Code Remote-SSH

With the SDK

Details