Default behavior
On first VM creation, the CLI registers your~/.ssh/id_rsa.pub and sets it as default. Your private key never leaves your machine.
Key types
Public keys (bring your own) — machine0 stores only the public half. Managed keys (server-generated) — the server creates the keypair and returns the private key once. Saved locally with0600 permissions. Required for MCP ssh_exec.
SSH users
Root login is disabled. Both users have full sudo.
In-browser terminal
For VMs created with a managed key, the web dashboard offers an in-browser terminal. Open a VM’s detail panel and select the SSH tab for a live shell right there, or go to/machines/<name>/terminal for the same terminal
full-screen. The detail panel remembers your last selected tab, so stepping
through machines on the SSH tab opens each one’s terminal directly. The
browser connects over WebSocket; the server uses the managed private key to
bridge to the VM’s sshd. No local SSH setup needed.
VMs created with a user-provided public key (the default) cannot use the
in-browser terminal — the server does not have the private key. Use
machine0 ssh <name> from your local terminal instead.
Sessions stay connected through long-running commands (the server sends a
4-minute keepalive frame) and auto-close after 30 minutes of inactivity —
the terminal keeps your scrollback and shows a reconnect button to start a
fresh session. Destroying the managed key via machine0 keys destroy or the
dashboard terminates any active terminal sessions using that key.