| name | ssh |
| description | Expose this machine over SSH via bore (public TCP tunnel). |
SSH Access
Exposes this machine over the internet via bore, a free TCP relay. Runs its own sshd on a dynamically allocated port inside the container (independent of the host SSH server, no port conflicts between containers) so all auth is fully controlled. No account required. The connecting machine only needs a standard SSH client.
Before running start.sh: get the client's public key
Ask the user to run this on the machine that will be connecting:
cat ~/.ssh/id_ed25519.pub
cat ~/.ssh/id_rsa.pub
If they don't have a key yet:
ssh-keygen -t ed25519
cat ~/.ssh/id_ed25519.pub
They should paste the full output (one line starting with ssh-ed25519 or ssh-rsa).
Start the tunnel
~/agent/skills/ssh/scripts/start.sh "ssh-ed25519 AAAA... user@laptop"
Running start.sh again with a different key adds it without removing existing ones (idempotent).
Connect from the other machine
The script prints the exact command. It will look like:
ssh -o StrictHostKeyChecking=accept-new root@bore.pub -p 12345
The host key is the container's sshd key and stays stable across bore reconnects.
If the connecting machine has multiple SSH keys and the wrong one is picked:
ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=accept-new root@bore.pub -p 12345
Check status
~/agent/skills/ssh/scripts/status.sh
Shows whether sshd and bore are running, the current connection command, and which keys are authorized.
Stop
~/agent/skills/ssh/scripts/stop.sh
Stops both the bore tunnel and the sshd process. Authorized keys remain in ~/.ssh/authorized_keys for the next session.
Notes
- Auth is key-only. Password auth and root password login are disabled.
- The bore port changes each time
start.sh is run. Share the new port with the connecting machine.
- Tunnel runs in a
screen session named bore-ssh. If bore dies unexpectedly: screen -r bore-ssh to inspect, then re-run start.sh.
- bore.pub is a public free service. Don't use it for long-term persistent access; it's for temporary sessions.
- To copy files over the tunnel:
scp -P 12345 -o StrictHostKeyChecking=accept-new file root@bore.pub:~/destination/
- To use rsync:
rsync -e "ssh -p 12345 -o StrictHostKeyChecking=accept-new" file root@bore.pub:~/destination/