ssh

crabbox ssh resolves a lease and prints a ready-to-run ssh command for it. It does not open a connection itself — it prints the command so you can copy it, pipe it, or wrap it in your own tooling.

Use crabbox connect when you want Crabbox to open the interactive SSH session directly.

crabbox ssh --id swift-crab
crabbox ssh --id swift-crab --network tailscale
crabbox ssh --provider ssh --target macos --static-host mac-studio.local

The first positional argument is treated as the lease id or slug, so crabbox ssh swift-crab is equivalent to crabbox ssh --id swift-crab.

What it prints

The printed command includes the per-lease private key (-i <key>) when Crabbox generated one, the resolved host, user, and port, and the connection options Crabbox uses internally (BatchMode, StrictHostKeyChecking=accept-new, a per-lease known_hosts file, and connection keepalives). For most providers that is a plain ssh -i … user@host -p <port> line you can run as-is.

crabbox ssh validates the local repo claim, then attempts a best-effort lease refresh to signal intended manual use. The refresh has a 20-second budget; failure warns and printing continues without guaranteeing renewed expiry. Cancellation by the caller stops the command without printing a successful result. Pass --reclaim when you are intentionally taking over a lease that is claimed by another repo checkout.

Before rebinding resolved access to a stored lease, Crabbox rejects conflicting known provider identities, including immutable generation IDs and numeric resource IDs. Missing identity fields remain unknown for compatibility with older claims; they do not establish ownership. When discarding a resolver-created alias, Crabbox removes its stored key only after validating and removing its unchanged claim. A key directory without an accompanying claim is retained.

Network selection

The --network flag controls which path to the box the command targets:

• auto (default) prefers the tailnet host when the lease carries Tailscale metadata and this client can reach it, otherwise falls back to the public provider host.
• tailscale requires the tailnet path and fails if it is unavailable.
• public always uses the provider's public host.

Provider-specific behavior

crabbox ssh works for any provider that exposes an SSH-reachable box. A few providers resolve access lazily or wrap the connection:

• provider=ssh (aliases static, static-ssh) resolves the configured static target from --static-host/--static-user/--static-port (or the matching config keys / CRABBOX_STATIC_HOST) instead of a leased machine.
• Token-based providers (for example daytona) authenticate with a short-lived SSH token embedded in the command. Crabbox redacts that secret by default and prints a warning; pass --show-secret only when you need a pasteable command in a trusted terminal.
• Proxy-based providers (for example sprites) print an ssh command with a provider ProxyCommand rather than a direct host connection.
• provider=xcp-ng resolves the VM IPv4 address from XCP-ng guest metrics during provisioning, then prints the normal per-lease SSH command for the cloud-init user.
• provider=coder prints a proxy-backed SSH command that uses coder ssh --stdio --wait <mode> <workspace>. Coder owns authentication and tunneling; Crabbox does not print or pass Coder tokens on argv.
• Provider-routed direct providers accept the same provider-specific routing flags here as status and stop; for example --kubevirt-context or --external-routing-file can select the exact lease backend when config defaults are not enough.

Flags

--id <lease-id-or-slug>     Lease to resolve (also accepted as the first argument).
--provider <name>           Provider to resolve against (default from config).
--target linux|macos|windows
--windows-mode normal|wsl2
--static-host <host>        Static target host (provider=ssh).
--static-user <user>        Static target user (provider=ssh).
--static-port <port>        Static target SSH port (provider=ssh).
--static-work-root <path>   Static target work root (provider=ssh).
--local-container-runtime <path-or-name>
                              Local container CLI override (provider=local-container).
--network auto|tailscale|public
--reclaim                   Claim this lease for the current repo before touching it.
--show-secret               Print secret auth material for token-based SSH providers.

--provider accepts any provider that supports SSH access; run crabbox providers to see the available set and their capabilities.

See also

• crabbox warmup — lease a box and wait until it is ready.
• crabbox connect — open an interactive SSH session directly.
• crabbox status / crabbox inspect — check lease state and connection details.
• crabbox vnc / crabbox code — other access bridges for desktop and editor leases.
• crabbox stop — end the lease when you are done.