Command ssh

Usage: juju ssh [options] <[user@]target> [openssh options] [command]


Initiates an SSH session or executes a command on a Juju machine.


-B, --no-browser-login (= false)

Do not use web browser for authentication

-m, --model (= "")

Model to operate in. Accepts [<controller name>:]<model name>

--no-host-key-checks (= false)

Skip host key checking (INSECURE)

--proxy (= false)

Proxy through the API server

--pty (= <auto>)

Enable pseudo-tty allocation


The machine is identified by the argument which is either a ‘unit name’ or a ‘machine id’. Both are obtained in the output to juju status. If ‘user’ is specified then the connection is made to that user account; otherwise, the default ‘ubuntu’ account, created by Juju, is used.

The optional command is executed on the remote machine, and any output is sent back to the user. If no command is specified, then an interactive shell session will be initiated.

When juju ssh is executed without a terminal attached, e.g. when piping the output of another command into it, then the default behavior is to not allocate a pseudo-terminal (pty) for the ssh session; otherwise a pty is allocated. This behavior can be overridden by explicitly specifying the behavior with --pty=true or --pty=false.

The SSH host keys of the target are verified. The --no-host-key-checks option can be used to disable these checks. Use of this option is not recommended as it opens up the possibility of a man-in-the-middle attack.

The default identity known to Juju and used by this command is ~/.ssh/id_rsa Options can be passed to the local OpenSSH client (ssh) on platforms where it is available. This is done by inserting them between the target and a possible remote command. Refer to the ssh man page for an explanation of those options.


Connect to machine 0:

juju ssh 0

Connect to machine 1 and run command ‘uname -a’:

juju ssh 1 uname -a

Connect to a mysql unit:

juju ssh mysql/0

Connect to a jenkins unit as user jenkins:

juju ssh jenkins@jenkins/0

Connect to a mysql unit with an identity not known to juju (ssh option -i):

juju ssh mysql/0 -i ~/.ssh/my_private_key echo hello

See also:


In case of a sidecar k8s charm, this isn’t clear if juju ssh unit/0 will bring me to the workload container or to the sidecar container. Can this be clarified? Thanks!


By default you’ll get to the charm container, you can change that by using the --container <container name> argument, for example

juju ssh --container postgres postgresql/0 /bin/bash

Where the container name is specified in metadata.yaml.

1 Like