What is SSH?

runtime sandboxes ssh <id> opens a shell in a Runtime sandbox. No port is open to the internet, and you do not copy a key. The CLI creates a key on first use and sends only the public half. It carries the session over Runtime's authenticated API. The same sandbox opens in VS Code or a JetBrains IDE as the host <id>.runtime (SSH and editors).

What the protocol is

RFC 4251, published in January 2006, begins: "The Secure Shell (SSH) Protocol is a protocol for secure remote login and other secure network services over an insecure network." It has three layers:

Layer	What it does
Transport	Authenticates the server, encrypts and checks every byte
User authentication	Proves who the client is: a key, a password, a certificate
Connection	Splits the one encrypted tunnel into channels: shells, commands, forwarded ports

The connection layer lets one SSH session carry a terminal, a file copy and a forwarded port at the same time.

SSH and a sandbox

A server on the internet must listen on port 22 and defend it. A sandbox does not. Runtime's API authenticates you with your key. It then connects your SSH client to the sandbox over one WebSocket. Nothing in the sandbox is reachable from outside. Each login gets a new host key, so the entry the CLI writes skips host-key checks on purpose. The connection already goes to the sandbox you named.

• runtime sandboxes ssh <id> -- make test runs one command and exits with its code.
• runtime sandboxes ssh config --install makes ssh, scp and rsync work with <id>.runtime.
• A sandbox from a custom image gets openssh-server installed on first use.

Related

• How to SSH into a sandbox
• How to use VS Code Remote SSH with a sandbox
• What is SSH port forwarding?
• What is a remote development environment?

Sources

Checked 25 October 2026.

• RFC 4251, The Secure Shell (SSH) Protocol Architecture
• Runtime SSH and editors