[HsingTang]

🥞 Stacked PR

• stack/sandbox-websocket-server [Files changed]
  • stack/sandbox-ssh-port-forward [Files changed]
    • stack/sandbox-ssh-setup [Files changed] ← this PR

---

Changes

Add databricks sandbox ssh-setup SANDBOX_ID --name ALIAS --profile PROFILE to write a local SSH Host configuration using the existing sandbox proxy mode. Native ssh, scp, and sftp can then connect using that alias. Setup requires an explicit Databricks profile, reuses local keys, retains a selected custom Databricks configuration file, and preserves unrelated SSH configuration. It does not start the sandbox.

Sandbox SSH configuration helpers live alongside the other new sandbox implementation under experimental/ssh/sandbox.

Why

Support native SSH tools through the same authenticated forwarding path as databricks sandbox ssh. Interactive CLI SSH continues to work without a persistent Host entry or an explicit setup step.

Tests

Unit tests cover profile requirements, alias validation, idempotency, overwrite protection, and preservation of unrelated configuration. Installed OpenSSH parses the generated configuration. Acceptance tests exercise setup, repeated setup, saved connection settings, and invalid input.

./task test-sandbox test-exp-ssh, affected race tests, and ./task fmt checks lint pass. The package-layout change was reviewed locally with Isaac, with no blocking findings.

This PR was written with Codex.

[github-actions]

Commit: a725f0c45 | Workflow run

Regression test report

Selected 1 changed tests (limit=20, 0 not selected)

1 tests: regression=1 unreleased=0 coverage=0 failing=0

test	branch	main (573c36e)	latest (v1.26.0)
TestAccept/cmd/sandbox/ssh-setup	✅	❌	❌

TestAccept/cmd/sandbox/ssh-setup: branch ✅ | main (573c36e) ❌ | latest (v1.26.0) ❌

main (573c36e):

acceptance_test.go:1374: Diff:
        --- cmd/sandbox/ssh-setup/output.txt
        +++ /tmp/TestAcceptcmdsandboxssh-setup852775957/002/output.txt
        @@ -1,25 +1,33 @@
         
         >>> [CLI] sandbox ssh-setup test --name my-sandbox --profile sandbox-test --releases-dir [TEST_TMP_DIR]/releases
        -Created SSH configuration at [TEST_TMP_DIR]/.databricks/ssh-tunnel-configs/my-sandbox. Connect with 'ssh my-sandbox' or 'scp ./file my-sandbox:/tmp/file'.
        +Error: unknown flag: --name
         
        ->>> [CLI] sandbox ssh-setup test --name my-sandbox --profile sandbox-test --releases-dir [TEST_TMP_DIR]/releases
        -Created SSH configuration at [TEST_TMP_DIR]/.databricks/ssh-tunnel-configs/my-sandbox. Connect with 'ssh my-sandbox' or 'scp ./file my-sandbox:/tmp/file'.
        +Usage:
        +  databricks sandbox [command]
         
        ->>> cat [TEST_TMP_DIR]/.ssh/config
        -Include "[TEST_TMP_DIR]/.databricks/ssh-tunnel-configs/*"
        +Available Commands:
        +  config      Configure a Sandbox's name and auto-stop policy
        +  create      Create a new Sandbox environment
        +  default     Set the default Sandbox for SSH
        +  delete      Delete a Sandbox environment
        +  list        List your Sandbox environments
        +  register    Register this machine for sandbox SSH access
        +  ssh         SSH into a Sandbox environment
        +  ssh-key     Manage SSH keys registered with the sandbox service
        +  start       Start a stopped Sandbox environment
        +  status      Show Sandbox environment status
        +  stop        Stop a running Sandbox environment
         
        ->>> cat [TEST_TMP_DIR]/.databricks/ssh-tunnel-configs/my-sandbox
        +Flags:
        +  -h, --help   help for sandbox
         
        -Host my-sandbox
        -    User sandbox-agent
        -    ConnectTimeout 900
        -    ServerAliveInterval 30
        -    StrictHostKeyChecking yes
        -    UserKnownHostsFile "[TEST_TMP_DIR]/.databricks/ssh-tunnel-known-hosts/[SSH_IDENTITY]"
        -    HostKeyAlias [SSH_IDENTITY]
        -    IdentitiesOnly yes
        -    IdentityFile "[TEST_TMP_DIR]/.databricks/ssh-tunnel-keys/[SSH_IDENTITY]/id_ed25519"
        -    ProxyCommand [CLI] sandbox ssh sandboxes/test --proxy --profile sandbox-test --releases-dir [TEST_TMP_DIR]/releases --ssh-identity [SSH_IDENTITY] --ssh-config-file [TEST_TMP_DIR]/databrickscfg
        +Global Flags:
        +      --debug            enable debug logging
        +  -o, --output type      output type: text or json (default text)
        +  -p, --profile string   ~/.databrickscfg profile
        +  -t, --target string    bundle target to use (if applicable)
         
        ->>> musterr [CLI] sandbox ssh-setup test --name ../escape
        -Error: SSH host alias must contain only letters, numbers, dots, underscores or hyphens
        +Use "databricks sandbox [command] --help" for more information about a command.
        +
        +
        +Exit code: 1
        
FAIL

latest (v1.26.0): same output as main (573c36e)

[eng-dev-ecosystem-bot]

✅ Integration test report

Commit: a725f0c

Run: 43517684503

	Env	💚​RECOVERED	✅​pass	🙈​skip	Time
💚​	aws linux-2core-8gb	1	270	16	5:28
💚​	aws-windows-latest-4core-16gb	1	272	14	4:29
💚​	azure linux-2core-8gb	1	269	16	5:16
💚​	azure-windows-latest-4core-16gb	1	271	14	4:19
💚​	gcp linux-2core-8gb	1	270	16	4:28
💚​	gcp-windows-latest-4core-16gb	1	272	14	4:56

	Test Name	aws linux-2core-8gb	aws-windows-latest-4core-16gb	azure linux-2core-8gb	azure-windows-latest-4core-16gb	gcp linux-2core-8gb	gcp-windows-latest-4core-16gb
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R

Top 3 slowest tests (at least 2 minutes):

duration	env	testname
3:28	azure-windows-latest-4core-16gb	TestAccept
3:28	aws-windows-latest-4core-16gb	TestAccept
2:52	gcp-windows-latest-4core-16gb	TestAccept