SSH access | DS Plane CLI

DS Plane creates an authenticated tunnel to the Dev Space SSH service, retrieves the workspace private key, and launches your local OpenSSH client.

Prerequisites

A running Dev Space with SSH enabled.
OpenSSH available as ssh on your PATH.
A valid landscape JWT.

OpenSSH is not required for non-SSH DS Plane commands.

Connect from interactive mode

Run dsplane.
Authenticate to a landscape.
Select a running Dev Space.
Select Connect, then SSH.

DS Plane waits for the Dev Space connection URL, fetches its private key, opens the tunnel, and starts ssh.

Connect with a command

dsplane ssh \
  --landscape https://example.applicationstudio.cloud.sap \
  --devspace MyDevSpace

Both options are required. The Dev Space name is its display name.

Save an SSH alias

On the first interactive SSH connection to a Dev Space, DS Plane offers to save a host alias. The suggested alias is:

MyDevSpace.devspace

If you accept, DS Plane adds a Host section to ~/.ssh/config. The section:

Uses the Dev Space user user.
References the fetched private key.
invokes dsplane ssh through ProxyCommand.
Disables known-host persistence for the local forwarded connection.

You can then connect with:

ssh MyDevSpace.devspace

Files created for SSH

DS Plane writes:

Private keys to ~/.ssh/<workspace-id>.key with mode 0600.
Host aliases to ~/.ssh/config.

The .ssh directory is created with mode 0700 when needed.

A Dev Space private key grants SSH access to that workspace. Do not share the generated key file.

How the connection works

DS Plane opens an authenticated WebSocket connection to port 443, establishes an SSH client session, and forwards a random localhost port to port 2222 in the Dev Space. The local OpenSSH process connects to that localhost port.

Troubleshooting

See Troubleshooting for missing OpenSSH, key permissions, and tunnel failures.