Virtual machines and SSH keys

A virtual machine is a Linux server of your own on your workspace's private network. You log in over SSH with your workspace's keys, as a user with passwordless sudo, and install whatever you need. Virtual machines are in the dashboard under Virtual machines.

Images

Every image is for 64-bit x86 processors.

Add an SSH key first

Virtual machines accept SSH keys only, never passwords, so a workspace needs at least one key before it can create one. Keys are on the workspace's SSH keys page.

1. Make a key pair on your computer if you do not have one, for example with ssh-keygen -t ed25519.
2. Choose New SSH key, give it a Name, such as the laptop it lives on, and paste the Public key: the one line of your .pub file, such as ~/.ssh/id_ed25519.pub.

The private key never leaves your computer. The list shows each key's fingerprint as SHA256:…, the same value ssh-keygen -lf prints for the file.

• Accepted key types: ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, and the security-key types [email protected] and [email protected].
• A name is 1 to 64 characters and only a label; names may repeat. The same key can be added to a workspace once.
• A key cannot be edited: delete it and add it again.

Create a virtual machine

Choose Virtual machines → New machine, or Create → New virtual machine, and pick an image:

• Machine name: 3 to 31 lowercase letters, digits and underscores, starting with a letter. It also names the machine's hostname.
• Login user, under Configure credentials: the image's default user unless you choose another, of up to 32 lowercase letters, digits and underscores. System names such as root, admin or sudo are refused.
• SSH keys: tick 1 to 10 of the workspace's keys. They are installed for the login user.
• Network access: Public, the default, or Private. See Connect.
• Plan: the machine's size, taken from your account's quota like any instance:

Choose Create instance. The Provisioning tab follows each step: Allocating resources, Preparing your private network, Cloning the machine image, Attaching the public IP, Booting the machine, Publishing the public address, and Ready. A private machine skips the public steps.

Connect

The machine's Overview shows the SSH command under Connection, ready to copy:

ssh [email protected] -p 40012

• Public: the hostname is under vm.sahabti.app, and the port is the machine's own public port on your workspace's shared IP, from 40000–49999, not 22. The hostname stays the same when you rename the machine.
• Private: no public address. The machine answers on port 22 of its private address, from other machines on your workspace network.

Password login and root login are off: connect as the login user with the key you selected, and use sudo when you need root. Inside the machine, public connections appear to come from the workspace router's address rather than the client's.

A public machine's SSH port is open to anyone until you restrict it. On its Network tab, choose Edit allowed sources on the built-in SSH rule and list the addresses you connect from. The same tab forwards more ports to the machine and makes it public or private: see Instance network.

Give or take away access

The keys you tick are installed when the machine is created. Changes on the SSH keys page later never reach machines that already exist:

• To let someone in, add their public key to ~/.ssh/authorized_keys of the login user, inside the machine.
• To lock someone out, remove their key from that file. Deleting it from the SSH keys page only stops it being offered for new machines.

Start, stop, resize and delete

• Start, Stop and Restart are in the machine's header. Stop shuts the machine down cleanly and switches it off if it has not stopped after a minute.
• Resize plan, on the Settings tab, changes the vCPU and memory of a running machine and restarts it to apply them, once you confirm Resize and restart. The disk and the network speed stay as they were.
• Rename changes the name in the console only.
• Delete instance, under Danger zone on the Settings tab, destroys the machine and everything on its disk; type confirm to confirm.

If creating the machine failed, Retry setup in the header runs it again.

What is yours to look after

The platform creates the machine, gives it its addresses, enforces its inbound rules and runs its power and size changes. Everything inside the operating system is yours: users and keys after creation, the software you install, your data and its backups.

• The distribution's security updates install automatically, and never restart the machine. Restart it yourself when an update needs it, such as a new kernel.
• The machine has no firewall of its own: its Network tab decides which public ports reach it.
• There are no snapshots or backups of a virtual machine, so keep your own copies of anything you cannot recreate.
• There is no browser console: SSH is the way in, so keep at least one working key in authorized_keys.

Who can do what

From the API and MCP

Create a machine with POST /v1/servers or the MCP tool create_instance, with the image as engine (debian, ubuntu or rocky), the keys as sshKeyIds, and a login user as dbUser. SSH keys are under /v1/ssh-keys, and over MCP list_ssh_keys, add_ssh_key and remove_ssh_key.