> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idyl.network/llms.txt
> Use this file to discover all available pages before exploring further.

# idyl ssh

> Connect to a workload with OpenSSH

Connect to a selected Pod or Sandbox container with the system OpenSSH client.

The CLI resolves the exact container capability, probes the trusted SSH
endpoint before reserving capacity, creates a short-lived one-use session, and
launches OpenSSH with directly attached terminal streams. Use --container when
the workload has multiple containers. A remote command selects exec mode.

## Usage

```bash theme={null}
idyl ssh pod/name|sandbox/name [-- command [args...]] [flags]
```

## Commands

| Command            | Description                             |
| ------------------ | --------------------------------------- |
| `idyl ssh prepare` | Prepare a one-use OpenSSH configuration |

## Flags

| Flag                   | Description                                                     |
| ---------------------- | --------------------------------------------------------------- |
| `--container <string>` | Exact container name.                                           |
| `--mode <string>`      | Reserved SSH mode: shell or exec.                               |
| `--port <string>`      | Raw SSH port: auto, 22, or 443. Default: `auto`.                |
| `--shell <string>`     | Absolute shell executable in the container. Default: `/bin/sh`. |

## Inherited flags

| Flag                                 | Description                                                        |
| ------------------------------------ | ------------------------------------------------------------------ |
| `-a <string>, --account-id <string>` | Account ID to use, overriding the current context.                 |
| `-c <string>, --context <string>`    | Use the named context for this command.                            |
| `--homedir <string>`                 | Override the configuration directory. Defaults to \~/.config/idyl. |
| `-n <string>, --namespace <string>`  | Namespace to address, overriding the entered context.              |
| `--network <string>`                 | Override the Network for this command.                             |
| `-p <string>, --profile <string>`    | Override the access profile for this command.                      |
| `-s <string>, --subnet <string>`     | Subnet to use for this command, overriding the current context.    |
| `--workspace <string>`               | Workspace within the namespace, overriding the entered context.    |

## Examples

```bash theme={null}
idyl ssh sandbox/dev
idyl ssh pod/web --container sidecar
idyl ssh sandbox/dev --shell /bin/bash
idyl ssh sandbox/dev --port 443
idyl ssh sandbox/dev -- uname -a
```

## Subcommand reference

### `idyl ssh prepare`

Prepare a short-lived one-use session for direct use by OpenSSH.

The command prints exactly one absolute ssh\_config path to stdout. Prepared
material remains local until session expiry and is pruned by later invocations.

#### Usage

```bash theme={null}
idyl ssh prepare pod/name|sandbox/name [flags]
```

#### Flags

| Flag                   | Description                                                     |
| ---------------------- | --------------------------------------------------------------- |
| `--container <string>` | Exact container name.                                           |
| `--mode <string>`      | Reserved SSH mode: shell or exec. Default: `shell`.             |
| `--port <string>`      | Raw SSH port: auto, 22, or 443. Default: `auto`.                |
| `--shell <string>`     | Absolute shell executable in the container. Default: `/bin/sh`. |

#### Examples

```bash theme={null}
ssh -F "$(idyl ssh prepare sandbox/dev)" idyl-session
ssh -F "$(idyl ssh prepare sandbox/dev --mode exec)" -- idyl-session uname -a
```