# Accessing Containers via SSH

This guide explains how to connect to your running container from a local
terminal using a reverse SSH tunnel via the MPE proxy. This is an advanced
workflow and is primarily useful for users who prefer local terminal emulators
or specific IDE integrations.

## Prerequisites

Before starting, ensure you have the following:

* **Publicly Accessible Server:** A publicly accessible server or proxy is
  required to establish the reverse tunnel (e.g., our MPE proxy
  `login1.mpe.mpg.de`). If you do not have an MPE account, any equivalent server
  you have access to will work. Creating reverse tunnels is a standard
  networking practice with many guides available online.
* **SSH Key Pair:** You must have an SSH key pair generated on your local
  laptop. If you do not have one, refer to online tutorials for `ssh-keygen`.
* **Persistent Storage:** You must use your personal data volume if you want
  your SSH configuration to survive container restarts.

## Setup and Connectivity

Because containers are **ephemeral**, any changes to the home directory
(including `~/.ssh`) are lost on restart. To make this setup persistent, we
store the configuration in your persistent volume and symlink it.

### 1. Persistent SSH Configuration (One-Time Setup)

First, create the SSH directory in your persistent storage. This only needs to
be done **once** across the lifetime of your account.

```bash
# Create the persistent SSH directory
mkdir -p ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh
chmod 700 ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh

# Generate the host key for the container's SSH server
ssh-keygen -t ed25519 -f ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/ssh_host_key -N ""
```

Inside your persistent `.ssh` folder, you must also create an
**`authorized_keys`** file and paste your laptop's public key (usually found in
`~/.ssh/id_rsa.pub` or `~/.ssh/id_ed25519.pub` on your local machine) into it:

```bash
# Ensure correct permissions for the keys file
chmod 600 ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/authorized_keys
```

### 2. SSH Daemon Configuration (One-Time Setup)

Create a file at
`~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/sshd_config` with the
following content:

```text
Port 2222
HostKey ~/.ssh/ssh_host_key
PidFile ~/.ssh/sshd.pid
StrictModes no
AuthorizedKeysFile ~/.ssh/authorized_keys
```

*Note: `StrictModes no` is required because the `.ssh` directory is a symlink.*

### 3. Activating SSH in a New Container

Because containers are **ephemeral**, you must run these steps every time you
start a new container session:

## Step A: Restore the symlink

```bash
ln -s /home/idies/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh /home/idies/.ssh
```

## Step B: Start the SSH server (inside the container)

```bash
/usr/sbin/sshd -D -e -f ~/.ssh/sshd_config
```

## Step C: Create the reverse tunnel (inside the container)

In a separate terminal tab, run the following to map the container's port to the
MPE proxy:

```bash
ssh -N -R 2222:localhost:2222 <MPE_USERNAME>@login1.mpe.mpg.de
```

### 4. Connect from your laptop

Now, use the MPE proxy as a jump host to reach the container:

```bash
ssh -J <MPE_USERNAME>@login1.mpe.mpg.de -p 2222 idies@localhost
```