ssh

Connect to a CVM via SSH

This command is marked as unstable and may change in future releases.

Command: phala ssh

Syntax

phala ssh [options] [<cvm_id>] [--] [...]

Description

Connect to a CVM via SSH

Arguments

Argument	Description
<cvm_id>?	CVM identifier (UUID, app_id, instance_id, or name)

Options

Option	Description
-p, --port <value>	Gateway port (priority: CLI > phala.toml > 443)
-g, --gateway <value>	Gateway domain (priority: CLI > phala.toml > API)
-t, --timeout <value>	Connection timeout in seconds (default: 30)
-v, --verbose	Show verbose connection details
--dry-run	Print SSH command without executing

Global Options

Option	Description
-h, --help	Show help information for the current command
--version	Show CLI version
--api-token TOKEN, --api-key TOKEN	API token for authenticating with Phala Cloud
-j, --json, --no-json	Output in JSON format
-i, --interactive	Enable interactive mode
--cvm-id <value>	CVM identifier (UUID, app_id, instance_id, or name)
--profile PROFILE	Temporarily use a different auth profile for this command
--api-version <value>	API version to use (e.g. 2025-10-28, 2026-01-21)

Pass-through Arguments

All arguments after — are passed directly to ssh. Common options: -i (identity file), -L (local forward), -R (remote forward), -D (SOCKS proxy), -N (no command), -v (ssh verbose). Any trailing arguments are executed as remote command. Note: -o ProxyCommand is blocked.

Examples

• Connect from phala.toml

phala ssh

• Connect to CVM

phala ssh app_123

• Offline mode

phala ssh app_123 -g dstack-pha-prod7.phala.network -p 16185

• Connect with custom SSH key

phala ssh app_123 -- -i ~/.ssh/custom_key

• Forward local port 8080 to remote port 80

phala ssh app_123 -- -L 8080:localhost:80

• SOCKS proxy without remote command

phala ssh app_123 -- -D 1080 -N

• Execute remote command

phala ssh app_123 -- ls -la /app

• Connect with verbose output for debugging

phala ssh app_123 -v

• Print the SSH command without executing

phala ssh app_123 --dry-run -- -L 8080:localhost:80