erun sshd

Enable SSH access to a remote environment — the prerequisite for attaching an IDE (erun open --vscode / --intellij) or connecting over plain SSH.

Synopsis

erun sshd init [TENANT] [ENVIRONMENT] [flags]
erun sshd sync [TENANT] [ENVIRONMENT] [flags]

What it does

1. Records SSHD as enabled in the environment's config and resolves the public key to authorize (auto-discovers ~/.ssh/id_ed25519.pub → id_ecdsa.pub → id_rsa.pub if --public-key isn't given).
2. Redeploys the runtime chart with sshd turned on — this is what starts sshd inside the pod.
3. Pushes your public key into the pod's authorized_keys.
4. Writes a host entry to your ~/.ssh/config (alias erun-<tenant>-<env>, user erun) so you can ssh erun-<tenant>-<env> directly.

The port-forward that makes the connection reachable is started later, when the environment is opened.

The alias is tied to the environment, not just to the port: erun delete removes the block again, so the alias cannot survive its environment and start resolving into whichever environment inherits its local port. erun list flags both directions of that check — an alias naming a configured environment that ~/.ssh/config does not declare, and a block ~/.ssh/config declares that no environment claims any more (stale ssh aliases).

Flags

Flag	Description
--public-key	Public key to authorize (defaults to an auto-discovered key).
--local-port	Fixed local port for the forward (defaults to the env's allocated SSH port).
--tenant, --environment	Target a specific tenant/environment.

Examples

erun sshd init my-tenant rihards-dev --dry-run
erun sshd init my-tenant rihards-dev
erun open my-tenant rihards-dev --vscode   # now possible

erun sshd sync

Runs one workspace-sync pass for a remote-agent environment: mirrors the pod's git-visible worktree into the host review directory, deletes what the pod no longer has, and delivers the pod's cross-built artifacts into the mirror's .erun-outputs/. See the workspace sync spec for the pass itself.

The desktop runs the same pass on a poller. This command exists so the pass is reachable without the desktop — an orchestrator whose mirror is empty or stale refreshes it in one call instead of working around it.

erun sshd sync my-tenant rihards-dev --dry-run   # counts only, mirror untouched
erun sshd sync my-tenant rihards-dev

--dry-run resolves the pass, traces the pod path and the host path it maps to, and reports the counts a real pass would change without creating, fetching, or deleting anything.

It refuses, naming which precondition failed, when the environment has no pod worktree (not a remote-agent env), has workspace sync disabled, has no configured local path, or when its SSH channel is not up.

Error behaviour

Failure	Behaviour
Environment is local (not remote).	Errors — SSH only applies to a remote environment.
No Kubernetes context configured.	Errors before any change.
No SSH public key found and none given.	Errors asking for --public-key.
Pod not ready when pushing the key.	Retries a few times, then errors.