Skip to content
Cloudflare Docs
Docs DirectoryAPIsSDKs

SSH

Anyone with write access to a Container can SSH into it with Wrangler as long as a matching public key is listed in authorized_keys.

SSH does not expose a publicly accessible port on the Container. The only way to connect is through Wrangler with wrangler containers ssh, which authenticates against your Cloudflare account.

Configure SSH

SSH can be configured in your Container's configuration with the ssh and authorized_keys properties. Only the ssh-ed25519 key type is supported.

The ssh.enabled property only controls whether you can SSH into a Container through Wrangler. It defaults to true. Set it to false to disable SSH access completely.

Connect with Wrangler

To SSH into a Container with Wrangler, add an ssh-ed25519 public key to authorized_keys in your Container configuration. The following example shows a basic configuration:

JSONC
{
  "containers": [
    {
      // other options here...
      "authorized_keys": [
        {
          "name": "<NAME>",
          "public_key": "<YOUR_PUBLIC_KEY_HERE>"
        }
      ]
    }
  ]
}

For more information on configuring SSH, refer to SSH configuration.

Find the instance ID for your Container by running wrangler containers instances or in the Cloudflare dashboard ↗. The instance you want to SSH into must be running. SSH will not start a stopped Container, and an active SSH connection alone will not keep a Container alive.

Once SSH is configured and the Container is running, open the SSH connection with:

Terminal window
wrangler containers ssh <INSTANCE_ID>

Process visibility

Without the containers_pid_namespace compatibility flag, all processes inside the VM are visible when you connect to your Container through SSH. This flag is turned on by default for Workers with a compatibility date of 2026-04-01 or later.