SSH access to Bluemix container via cf-ssh

There are frequent questions related to how to access Bluemix container via ssh command. Bluemix is a PaaS. Hence it is not providing infrastructure, but a platform to run application with various run-times (Java, Ruby, Node, PHP, etc) without worry about infrastructure too much. But sometimes, developers want to login solely for debugging purpose. There several articles which mentions about how to access container. For example, “Easy SSH Sessions into Bluemix”  mentions about using “cf-ssh” to access Bluemix container. However, unfortunately it does not tell how to run your application for the debugging.

This blog entry is a kind second article mentioned above to actually run the application. The original idea comes from article by excellent engineer Kusama-san (@jacopen) (link to article written in Japanese). This blog entry is mostly relies on his article.


First of all, what is “cf-ssh” ?  This is a utility to access container for Cloud Foundry base PaaS via ssh. As both articles explains, the idea comes from Dr. Nic (link to article) using tmate technology. This technology share’s console so that developer can easily take a look at container through console. His article explains about cf-ssh script. There is yet another, but much simpler implementation of “cf-ssh” in Cloud Foundry community (

This utility can be downloaded from here . Cloud Foundry CLI (cf) and ssh command must be installed to use “cf-ssh” utility. I verified this utility on Linux platform (Ubuntu), so this method may not work on Windows platform.

The usage is very simple. Under the directory of application, run:

$ cf-ssh -f manifest.yml

That’s it !

Note that manifest.yml is required to use this utility. If it succeeds, it opens a connection to public terminal sharing on, and then login to that terminal. The application sources as well as buildpack (run-time) is also deployed on the container. The application is deployed as <appname>-ssh with no route. Note that the session is one time only.

2015-01-15 15_09_02 terminal

Create a route

The application is deployed without route. But we can create a route for this application so that we can use web browser to access to the application.

$ cf create-route <space> -n <appname>-ssh
Creating route <appname> ...

$ cf map-route <appname>-ssh -n <appname>-ssh
Adding route ...

Run the application

A tmate-bootstrap is run as an application for “<appname>-ssh”. This also works as a reverse proxy. The expected application port is 8080. So we need to modify the listen port from VCAP_ENV_PORT to 8080. For example, in case of Node application, I need to modify like this:

//var port = (process.env.VCAP_APP_PORT || 3000);
var port = 8080;

Then, I can run the application (Node application in this case) from the terminal.

vcap@18ckfi1j8nh:~$ node app.js

As I imagined, I can view the application from web browser, and also take a look at console at the same time !

2015-01-15 15_14_12-run the application

2015-01-15 15_13_15-application

Most likely, this technique can be used for debugging purpose. For example, there is a situation that the problem only happens in Bluemix environment, not in development environment, and “cf logs” gives no clue for us.

It may be possible to access to the backend services from this terminal. For example, upload initial data to mysql, query existing database, so on. Unfortunately, I have not explored this option yet (but put the idea as my blog backlog 🙂 ).

I have to remind that for true terminal services, we can leverage Bluemix container service, as “cf-ssh” is not intended to provide terminal for the developers.

This entry was posted in Bluemix. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s