# What is SSH?

SSH (Secure Shell) is the protocol for logging in to a remote computer and
running commands over an encrypted connection.

**`runtime sandboxes ssh <id>` opens a shell in a Runtime sandbox. No port is
open to the internet, and you do not copy a key.** The CLI creates a key on
first use and sends only the public half. It carries the session over Runtime's
authenticated API. The same sandbox opens in VS Code or a JetBrains IDE as the
host `<id>.runtime` ([SSH and editors](/docs/editors)).

## What the protocol is

RFC 4251, published in January 2006, begins: "The Secure Shell (SSH) Protocol is
a protocol for secure remote login and other secure network services over an
insecure network." It has three layers:

| Layer               | What it does                                                                     |
| ------------------- | -------------------------------------------------------------------------------- |
| Transport           | Authenticates the server, encrypts and checks every byte                         |
| User authentication | Proves who the client is: a key, a password, a certificate                       |
| Connection          | Splits the one encrypted tunnel into channels: shells, commands, forwarded ports |

The connection layer lets one SSH session carry a terminal, a file copy and a
[forwarded port](/glossary/ssh-port-forwarding) at the same time.

## SSH and a sandbox

A server on the internet must listen on port 22 and defend it. A sandbox does
not. Runtime's API authenticates you with your key. It then connects your SSH
client to the sandbox over one WebSocket. Nothing in the sandbox is reachable
from outside. Each login gets a new host key, so the entry the CLI writes skips
host-key checks on purpose. The connection already goes to the sandbox you
named.

- `runtime sandboxes ssh <id> -- make test` runs one command and exits with its code.
- `runtime sandboxes ssh config --install` makes `ssh`, `scp` and `rsync` work
  with `<id>.runtime`.
- A sandbox from a custom image gets `openssh-server` installed on first use.

## Related

- [How to SSH into a sandbox](/how-to/ssh-into-a-sandbox)
- [How to use VS Code Remote SSH with a sandbox](/how-to/use-vs-code-remote-ssh)
- [What is SSH port forwarding?](/glossary/ssh-port-forwarding)
- [What is a remote development environment?](/glossary/remote-development-environment)

## Sources

Checked 25 October 2026.

- [RFC 4251, The Secure Shell (SSH) Protocol Architecture](https://www.rfc-editor.org/rfc/rfc4251)
- [Runtime SSH and editors](/docs/editors)