ssh

ssh

crabbox ssh resolves a lease and prints a ready-to-run ssh command for it. It does not open a connection itself — it prints the command so you can copy it, pipe it, or wrap it in your own tooling.

Use crabbox connect when you want Crabbox to open the interactive SSH session directly.

crabbox ssh --id swift-crab
crabbox ssh --id swift-crab --network tailscale
crabbox ssh --provider ssh --target macos --static-host mac-studio.local

The first positional argument is treated as the lease id or slug, so crabbox ssh swift-crab is equivalent to crabbox ssh --id swift-crab.

What it prints

The printed command includes the per-lease private key (-i <key>) when Crabbox generated one, the resolved host, user, and port, and the connection options Crabbox uses internally (BatchMode, StrictHostKeyChecking=accept-new, a per-lease known_hosts file, and connection keepalives). For most providers that is a plain ssh -i … user@host -p <port> line you can run as-is.

crabbox ssh validates the local repo claim, then attempts a best-effort lease refresh to signal intended manual use. The refresh has a 20-second budget; failure warns and printing continues without guaranteeing renewed expiry. Cancellation by the caller stops the command without printing a successful result. Pass --reclaim when you are intentionally taking over a lease that is claimed by another repo checkout.

Network selection

The --network flag controls which path to the box the command targets:

• auto (default) prefers the tailnet host when the lease carries Tailscale metadata and this client can reach it, otherwise falls back to the public provider host.
• tailscale requires the tailnet path and fails if it is unavailable.
• public always uses the provider's public host.

Provider-specific behavior

crabbox ssh works for any provider that exposes an SSH-reachable box. A few providers resolve access lazily or wrap the connection:

• provider=ssh (aliases static, static-ssh) resolves the configured static target from --static-host/--static-user/--static-port (or the matching config keys / CRABBOX_STATIC_HOST) instead of a leased machine.
• Token-based providers (for example daytona) authenticate with a short-lived SSH token embedded in the command. Crabbox redacts that secret by default and prints a warning; pass --show-secret only when you need a pasteable command in a trusted terminal.
• Proxy-based providers (for example sprites) print an ssh command with a provider ProxyCommand rather than a direct host connection.
• provider=xcp-ng resolves the VM IPv4 address from XCP-ng guest metrics during provisioning, then prints the normal per-lease SSH command for the cloud-init user.
• provider=coder prints a proxy-backed SSH command that uses coder ssh --stdio --wait <mode> <workspace>. Coder owns authentication and tunneling; Crabbox does not print or pass Coder tokens on argv.
• Provider-routed direct providers accept the same provider-specific routing flags here as status and stop; for example --kubevirt-context or --external-routing-file can select the exact lease backend when config defaults are not enough.