Accessing Containers via SSH

This guide explains how to connect to your running container from a local terminal using a reverse SSH tunnel via the MPE proxy. This is an advanced workflow and is primarily useful for users who prefer local terminal emulators or specific IDE integrations.

Prerequisites

Before starting, ensure you have the following:

  • Publicly Accessible Server: A publicly accessible server or proxy is required to establish the reverse tunnel (e.g., our MPE proxy login1.mpe.mpg.de). If you do not have an MPE account, any equivalent server you have access to will work. Creating reverse tunnels is a standard networking practice with many guides available online.

  • SSH Key Pair: You must have an SSH key pair generated on your local laptop. If you do not have one, refer to online tutorials for ssh-keygen.

  • Persistent Storage: You must use your personal data volume if you want your SSH configuration to survive container restarts.

Setup and Connectivity

Because containers are ephemeral, any changes to the home directory (including ~/.ssh) are lost on restart. To make this setup persistent, we store the configuration in your persistent volume and symlink it.

1. Persistent SSH Configuration (One-Time Setup)

First, create the SSH directory in your persistent storage. This only needs to be done once across the lifetime of your account.

# Create the persistent SSH directory
mkdir -p ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh
chmod 700 ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh

# Generate the host key for the container's SSH server
ssh-keygen -t ed25519 -f ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/ssh_host_key -N ""

Inside your persistent .ssh folder, you must also create an authorized_keys file and paste your laptop’s public key (usually found in ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub on your local machine) into it:

# Ensure correct permissions for the keys file
chmod 600 ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/authorized_keys

2. SSH Daemon Configuration (One-Time Setup)

Create a file at ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/sshd_config with the following content:

Port 2222
HostKey ~/.ssh/ssh_host_key
PidFile ~/.ssh/sshd.pid
StrictModes no
AuthorizedKeysFile ~/.ssh/authorized_keys

Note: StrictModes no is required because the .ssh directory is a symlink.

3. Activating SSH in a New Container

Because containers are ephemeral, you must run these steps every time you start a new container session:

Step B: Start the SSH server (inside the container)

/usr/sbin/sshd -D -e -f ~/.ssh/sshd_config

Step C: Create the reverse tunnel (inside the container)

In a separate terminal tab, run the following to map the container’s port to the MPE proxy:

ssh -N -R 2222:localhost:2222 <MPE_USERNAME>@login1.mpe.mpg.de

4. Connect from your laptop

Now, use the MPE proxy as a jump host to reach the container:

ssh -J <MPE_USERNAME>@login1.mpe.mpg.de -p 2222 idies@localhost