# Shell and SSH

> Open a shell on a running Ownkube app from the dashboard or with okctl ssh, run one-off commands, use scp and sftp, and connect to a database or cache with okctl connect.

Get a shell on a running web app, worker or job container to inspect files, run a one-off script or poke at a problem, from the dashboard or from your terminal over SSH. For a database or cache, `okctl connect` opens `psql` or `valkey-cli`, or a tunnel to a local port.

Shell and SSH are available on Ownkube Compute to organization owners and admins. They are not exposed through the [MCP server](/docs/mcp).

## From the dashboard

Open the deployment and choose **Shell** from the actions menu on the **Overview** tab. If the deployment has more than one replica, pick the instance. A terminal opens in the browser attached to that container.

## From the terminal

1. **Install and sign in**

   `okctl` v0.5.0 or later. See the [CLI](/docs/cli) for install and `okctl login`.

2. **Open a shell**

   ```bash
   okctl ssh <deployment-id>
   ```

   The first run generates an SSH key if you have none and adds the public key to your Ownkube account. Omit the deployment id inside a directory you have [linked](/docs/cli#link-a-directory) with `okctl link`.

3. **Run one command**

   ```bash
   okctl ssh <deployment-id> -- ls -la /app
   okctl ssh <deployment-id> -- python manage.py migrate
   ```

## Use plain ssh, scp and sftp

`okctl ssh config` writes an entry for each of your apps into `~/.ssh/config`, so the standard tools work:

```bash
okctl ssh config
ssh ok-my-api
scp ./fixture.json ok-my-api:/tmp/
sftp ok-my-api
```

## Manage SSH keys

Keys live on your user account, not on a deployment, under **Settings** → **Profile** → **SSH keys** in the [dashboard](https://app.ownkube.io/dashboard/settings).

<img src="/docs/screenshots/settings-profile.webp" alt="Screenshot of the Profile settings page with the SSH keys section" />

```bash
okctl ssh keys list
okctl ssh keys add ~/.ssh/id_ed25519.pub
okctl ssh keys github <username>   # import your public keys from GitHub
okctl ssh keys remove <key-id>
```

## Connect to a database or cache

#### Postgres

```bash
okctl connect <database-id>
```

Opens `psql` against the database with the right credentials. Needs `psql` on your machine.

#### Valkey

```bash
okctl connect <cache-id>
```

Opens `valkey-cli` with TLS and the server name set for you. Needs `valkey-cli` on your machine.

#### Tunnel only

```bash
okctl connect <database-id> --tunnel-only
```

Forwards a local port to the database or cache without opening a client, for GUI tools and migrations run from your laptop.

`okctl connect` works over [private networking](/docs/networking/private) and does not require public access on the database. For a browser-based query console, see the [data console](/docs/data/console).

## Things to know

- A shell runs inside the container with the same user and filesystem as your app. Changes to the filesystem do not survive a restart or a new revision; put them in the image or a variable instead.
- A sleeping app has no container to attach to. Send it a request first, or turn [sleep](/docs/deployments/sleep) off while you debug.

- [CLI (okctl)](/docs/cli)
- [Logs](/docs/observability/logs)
- [Data console](/docs/data/console)

---

**Don't see a feature you need?** Email [support@ownkube.io](mailto:support@ownkube.io?subject=Feature%20request). Ownkube is shaped by the teams using it and we ship what our users ask for.

## Search

This site has a search endpoint: https://context7.com/api/v2/ask?siteKey=ask_c64dfe8ffaa8d3ad19576838&query=<URL-encoded question>. It returns documentation that answers the question, with a source link for each part. No API key is needed. If nothing matches, it says so.