# SSH Into a Cloud Sandbox From VS Code or Cursor > Run sbx ssh-config --install once. It adds a Host *.sbx entry to ~/.ssh/config that tunnels through the sbx CLI over HTTPS, so ssh, rsync and VS Code or Cursor Remote-SSH reach any sandbox as .sbx, with no open ports and no keys to manage by hand. Source: https://sandboxer.com/guides/ssh-into-a-cloud-sandbox-from-vs-code-or-cursor. Updated 2026-10-27. **Short answer:** Run sbx ssh-config --install once. It adds a Host *.sbx entry to ~/.ssh/config that tunnels through the sbx CLI over HTTPS, so ssh, rsync and VS Code or Cursor Remote-SSH reach any sandbox as .sbx, with no open ports and no keys to manage by hand. ## Three ways in Every sandbox runs a standard OpenSSH server as `user`. You can reach it three ways: | Route | How you connect | Needs | Best for | | - | - | - | - | | Tunnel via `sbx ssh-config` | `ssh sb_xxx.sbx` | Outbound HTTPS only | Editors, `rsync`, `scp`, anything that reads `~/.ssh/config` | | IPv4 `sshEndpoint` | `ssh -p user@` | TCP to that port | SSH clients that can't run a `ProxyCommand` | | Direct IPv6 | `ssh user@` | IPv6 on your network | Networks with IPv6 | The tunnel is the one to use for an editor. It works behind corporate firewalls, it uses the sandbox id as the host name, and the CLI authorizes its key and pins the host key on every connection. ## 1. Get a sandbox and try sbx ssh ```bash sbx new --name aeo-ssh-1 --type small sbx ssh sb_sohclk8pmb "uname -a; whoami; pwd" ``` ```text Linux solid-zesty-koala 6.18.56-sandboxer #2 SMP PREEMPT_DYNAMIC Tue Oct 13 02:50:06 CEST 2026 x86_64 x86_64 x86_64 GNU/Linux user /home/user ``` `sbx ssh` keeps a dedicated key at `~/.ssh/sandboxer_ed25519` and authorizes it on the sandbox the first time. The remote exit code is passed through: `sbx ssh sb_sohclk8pmb "exit 7"` exits with 7. ## 2. Add the SSH config entry ```bash sbx ssh-config --install ``` ```text Added the Sandboxer stanza to /home/you/.ssh/config. Try: ssh .sbx ``` Running it again changes nothing (`… already has the Sandboxer stanza.`). This is the block it writes. Paths are absolute on your machine. Here the home directory is shortened to `/home/you` and the `sbx` path to `/usr/local/bin/sbx`: ```ini # Sandboxer (sbx ssh-config) Host *.sbx User user IdentityFile /home/you/.ssh/sandboxer_ed25519 IdentitiesOnly yes ProxyCommand /usr/local/bin/sbx proxy %h UserKnownHostsFile /home/you/.config/sandboxer/known_hosts StrictHostKeyChecking yes ServerAliveInterval 30 ``` `sbx proxy` bridges the SSH connection to port 22 of the sandbox over an authenticated WebSocket. Before it connects, it authorizes the CLI key and pins the sandbox's current host key, so `StrictHostKeyChecking yes` holds without any prompt. To see the block without writing it, run `sbx ssh-config` with no flag. ## 3. Use plain ssh, rsync and scp Any OpenSSH tool now reaches the sandbox as `.sbx`: ```bash ssh sb_sohclk8pmb.sbx "uname -sr; hostname; nproc" ``` ```text Linux 6.18.56-sandboxer solid-zesty-koala 2 ``` That round trip took 1.5 seconds, including the authorize step (one measured run on prod, 2026-10-27). Sync a local folder and read a file back: ```bash rsync -av ./app/ sb_sohclk8pmb.sbx:app/ ssh sb_sohclk8pmb.sbx "node app/index.js" scp sb_sohclk8pmb.sbx:app/README.md ./back.md ``` ```text sending incremental file list created directory app ./ README.md index.js sent 224 bytes received 83 bytes 122.80 bytes/sec total size is 37 speedup is 0.12 hi from laptop ``` ## 4. Open it in VS Code or Cursor In VS Code, install the Remote - SSH extension, open the Command Palette and choose **Remote-SSH: Connect to Host…**, then type `sb_sohclk8pmb.sbx`. Remote-SSH reads hosts from your SSH config file, so the `Host *.sbx` entry above is all it needs. If you keep that entry in a different file, point the `remote.SSH.configFile` setting at it ([VS Code Remote-SSH docs](https://code.visualstudio.com/docs/remote/ssh)). Open `/home/user` or your repo folder once it connects. Cursor imports VS Code settings and extensions and installs extensions from the Open VSX registry ([Cursor: migrate from VS Code](https://cursor.com/help/getting-started/migrate-vscode.md)). Install a Remote-SSH extension there and connect to the same `sb_xxx.sbx` host. We couldn't open a GUI editor for this guide. What we checked is the part the editor depends on: the SSH connection through that exact config block, and that the sandbox is the kind of host VS Code's server supports (glibc-based x86_64 Linux, glibc 2.17 or newer) with `tar`, `curl` and `wget` present: ```bash ssh sb_sohclk8pmb.sbx "ldd --version | head -1; which tar curl wget" ``` ```text ldd (Ubuntu GLIBC 2.39-0ubuntu8.9) 2.39 /usr/bin/tar /usr/bin/curl /usr/bin/wget ``` ## 5. Reach a dev server from your laptop Start a server in the sandbox, then forward its port. Either use the CLI: ```bash sbx exec sb_sohclk8pmb --detach "mkdir -p site && cd site && echo hello-from-port-3000 > index.html && python3 -m http.server 3000" sbx forward sb_sohclk8pmb --remote 3000 --local 13000 curl http://127.0.0.1:13000/ ``` ```text hello-from-port-3000 ``` Or plain SSH local forwarding through the same config entry, which is what an editor's port forwarding uses: ```bash ssh -N -L 13001:127.0.0.1:3000 sb_sohclk8pmb.sbx curl http://127.0.0.1:13001/ ``` ```text hello-from-port-3000 ``` Nothing becomes public either way. For a shareable HTTPS URL, use `sbx host` ([Hosting](/docs/hosting)). ## Without the CLI: the IPv4 endpoint `sbx info` shows the sandbox's public IPv4 `sshEndpoint`, a `host:port` forwarded to port 22 while it runs: ```text ID: sb_sohclk8pmb State: ready Type: small (2 vCPU, 4 GB) IP: 2a01:4f9:3120:1d84::5b00:10 SSH endpoint: 62.238.91.250:22015 … ``` ```bash ssh -i ~/.ssh/sandboxer_ed25519 -p 22015 user@62.238.91.250 "hostname" ``` ```text solid-zesty-koala ``` The key must be authorized on that sandbox first. `sbx ssh` does it for the CLI key, or you can add your own public key through the API ([SSH docs](/docs/ssh)). An editor config for this route uses `HostName`, `Port` and `IdentityFile` instead of `ProxyCommand`. Prefer the `.sbx` tunnel when you can: the endpoint port belongs to the running sandbox, while the `.sbx` host name is just the id. Direct IPv6 (`ssh user@`) needs IPv6 on your side. Our test machine had none and got `Network is unreachable`, which is the error to expect in that case. The tunnel and the IPv4 endpoint both worked from the same machine. ## FAQ ### Do I need to open any ports or copy keys? No. The `.sbx` entry tunnels over outbound HTTPS through the CLI, and each connection authorizes the CLI key and pins the host key for you. ### Does the editor connection survive a stop and resume? The host name is the sandbox id, which doesn't change, and `sbx proxy` pins the sandbox's current host key on each connection. After `sbx resume`, reconnect to the same `sb_xxx.sbx` host. `sbx forward` reconnects on its own if the sandbox moves. ### Why does my editor say "Could not establish connection"? Check plain `ssh sb_xxx.sbx true` in a terminal first. If the sandbox is stopped, resume it. If `sbx` isn't signed in on that computer, run `sbx login`, because the `ProxyCommand` uses the CLI's saved sign-in. ### Can I use JetBrains Gateway or Ansible the same way? Any tool that uses OpenSSH and reads `~/.ssh/config` can use the `Host *.sbx` entry. We tested `ssh`, `scp` and `rsync` for this guide. ### What user and home directory will I land in? `user`, in `/home/user`, with root available through `sudo`. ## Related - [SSH and file transfer](/docs/ssh) - [CLI reference](/docs/cli) - [Run Claude Code in a cloud VM](/guides/run-claude-code-in-a-cloud-vm) - [Pause and resume a sandbox with its memory](/guides/pause-and-resume-a-sandbox-with-memory)