# SSH access - Documentation

> You can use a WebSocket proxy to connect to your sandbox via SSH

> For the complete documentation index, see [llms.txt](/llms.txt). Markdown is available with `Accept: text/markdown` and `.md` URL variants.

Source: /docs/guides/sandbox-ssh-access

# SSH access

You can use a WebSocket proxy to connect to your sandbox via SSH

By using SSH, you can securely connect to a remote command-line environment, transfer files through protocols such as SCP or SFTP, and work with software that relies on SSH-based connections.

##

[​](#quickstart)

Quickstart

1

Build the SSH template

Define a template that includes an OpenSSH server for SSH access and [websocat](https://github.com/vi/websocat) for forwarding WebSocket-based connections:

JavaScript & TypeScript

Python

```
// template.ts
import { Template, waitForPort } from 'novita-sandbox/code-interpreter'

export const template = Template()
.fromUbuntuImage('25.04')
.aptInstall(['openssh-server'])
.runCmd([
'curl -fsSL -o /usr/local/bin/websocat https://github.com/vi/websocat/releases/latest/download/websocat.x86_64-unknown-linux-musl',
'chmod a+x /usr/local/bin/websocat',
], { user: 'root' })
.setStartCmd('sudo websocat -b --exit-on-eof ws-l:0.0.0.0:8081 tcp:127.0.0.1:22', waitForPort(8081))
```

Now build it:

JavaScript & TypeScript

Python

```
// build.ts
import { Template, defaultBuildLogger } from 'novita-sandbox/code-interpreter'
import { template as sshTemplate } from './template'

await Template.build(sshTemplate, 'ssh-ready', {
cpuCount: 2,
memoryMB: 2048,
onBuildLogs: defaultBuildLogger(),
})
```

2

Launch a sandbox from that template

JavaScript & TypeScript

Python

```
import { Sandbox } from 'novita-sandbox/code-interpreter'

const sbx = await Sandbox.create('ssh-ready')
console.log(sbx.sandboxId)
```

3

Connect from your local machine

macOS

Linux

```
# Install websocat
brew install websocat

# Connect to your sandbox
ssh -o 'ProxyCommand=websocat --binary -B 65536 - wss://8081-%h.sandbox.novita.ai' user@
```

##

[​](#how-it-works)

How it works

[Websocat](https://github.com/vi/websocat) acts as the proxy, and SSH connections are forwarded over WebSocket through the sandbox’s exposed ports.

```
┌───────────────────────────────────────────────────────────┐
│ Your Machine │
│ ┌──────────┐ ProxyCommand ┌──────────────────┐ │
│ │ SSH │ ────────────────── │ websocat │ │
│ │ Client │ │ (WebSocket) │ │
│ └──────────┘ └─────────┬────────┘ │
└────────────────────────────────────────────┼──────────────┘
│
wss://8081-.sandbox.novita.ai
│
┌────────────────────────────────────────────┼──────────────┐
│ Novita Sandbox ▼ │
│ ┌──────────────────┐ │
│ │ websocat │ │
│ │ (WS → TCP:22) │ │
│ └─────────┬────────┘ │
│ │ │
│ ┌─────────▼────────┐ │
│ │ SSH Server │ │
│ │ (OpenSSH) │ │
│ └──────────────────┘ │
└───────────────────────────────────────────────────────────┘
```

Last modified on June 4, 2026