Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara menggunakan CLI gcloud untuk terhubung ke workstation dari mesin lokal menggunakan SSH (atau protokol TCP lainnya).
Cloud Workstations menggunakan tunnel untuk meneruskan traffic TCP antara port di mesin lokal Anda dan port di workstation Anda tanpa mengekspos workstation Anda secara terbuka ke internet. Koneksi diautentikasi menggunakan
kredensial dari CLI gcloud dan diizinkan sesuai dengan
kebijakan IAM workstation target.
Setelah tunnel TCP dibuat antara port lokal dan workstation, Anda dapat menggunakannya untuk meneruskan traffic dari klien SSH, curl, atau aplikasi lain yang menggunakan TCP.
Untuk mempermudah, Cloud Workstations menyediakan perintah
gcloud workstations ssh
yang membuat tunnel TCP dan menjalankan klien SSH dengan satu perintah
CLI gcloud.
Untuk semua kasus penggunaan lainnya, gunakan perintah
gcloud workstations start-tcp-tunnel
untuk membuat tunnel TCP dan menjalankan aplikasi yang akan menggunakan
tunnel (misalnya, curl) di terminal terpisah.
PROJECT_ID: Google Cloud project ID untuk project yang berisi workstation. Jika dihilangkan, project saat ini akan digunakan.
REGION: region tempat cluster workstation berada—misalnya, us-central1.
CLUSTER_NAME: nama cluster workstation
yang berisi workstation.
CONFIG_NAME: nama konfigurasi workstation
yang berisi workstation ini.
WORKSTATION_PORT (Opsional): port di workstation
yang akan dituju untuk mengirim traffic. Jika tidak ditentukan, traffic akan dikirim ke port 22. Semua image Cloud Workstations yang telah dikonfigurasi sebelumnya menyertakan server SSH yang berjalan di port workstation 22.
LOCAL_PORT (Opsional): port localhost yang menjadi asal pengiriman traffic. Nomor port yang valid adalah 1024 hingga 65535. Jika Anda menghilangkan
flag --local-host-port atau menentukan port 0, port yang tidak digunakan akan
dipilih secara otomatis.
WORKSTATION_NAME: nama workstation.
Opsional: Untuk meneruskan tanda dan posisi ke penerapan ssh
yang mendasarinya, tambahkan ke perintah setelah tanda hubung ganda (--).
Menggunakan tunnel TCP untuk meneruskan traffic TCP arbitrer ke workstation Anda
PROJECT_ID: Google Cloud project ID untuk project yang berisi workstation. Jika dihilangkan, project saat ini akan digunakan.
REGION: region tempat cluster workstation berada—misalnya, us-central1.
CLUSTER_NAME: nama cluster workstation
yang berisi workstation.
CONFIG_NAME: nama konfigurasi workstation yang berisi workstation ini.
LOCAL_PORT (Opsional): port localhost yang menjadi asal pengiriman traffic. Nomor port yang valid adalah 1024 hingga 65535. Jika Anda
menghilangkan tanda --local-host-port atau menentukan port 0, port yang tidak digunakan
akan dipilih secara otomatis.
Perintah CLI gcloud melakukan uji konektivitas dengan
workstation, membuka tunnel, lalu menampilkan nomor port:
Listening on port [LOCAL_PORT].
Semua traffic yang dikirim ke localhost:LOCAL_PORT diteruskan ke
workstation. Port hanya dapat diakses oleh aplikasi yang berjalan di komputer lokal Anda.
Biarkan CLI gcloud berjalan dan buka terminal lain untuk menjalankan aplikasi yang terhubung ke workstation Anda.
Misalnya, jika Anda menjalankan server di workstation yang melayani port WORKSTATION_PORT, dan pada langkah sebelumnya Anda membuat tunnel TCP yang meneruskan traffic antara port lokal LOCAL_PORT dan port workstation WORKSTATION_PORT, Anda dapat menjalankan curl di mesin lokal untuk terhubung ke server di workstation:
curl localhost:LOCAL_PORT
Hello, world!
Setelah selesai, kembali ke terminal tempat Anda memulai tunnel TCP dan hentikan CLI gcloud dengan menekan Control+C.
Menggunakan server SSH di port yang berbeda
Image container kustom
juga dapat menggunakan server SSH di port apa pun. Untuk mendukung koneksi dari tunnel CLI gcloud, Anda harus mengonfigurasi server SSH kustom untuk mengizinkan autentikasi sandi dan menetapkan pengguna target dengan sandi kosong.
Cloud Workstations menggunakan
Cloud IAM
untuk membantu memastikan bahwa hanya traffic yang sah yang dikirim ke server SSH.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-11 UTC."],[],[],null,["# SSH support\n\nThis page describes how to use the `gcloud` CLI to connect to your\nworkstation from a local machine using SSH (or any other TCP protocol).\n\nCloud Workstations uses a tunnel to forward TCP traffic between a port on your\nlocal machine and a port on your workstation without openly exposing\nyour workstation to the internet. Connections are authenticated using\ncredentials from the `gcloud` CLI and authorized according to the\ntarget workstation's IAM policies.\n\nOnce the TCP tunnel is established between your local port and the workstation,\nyou can use it to forward traffic from an SSH client, curl, or any other\napplication that uses TCP.\n\nFor convenience, Cloud Workstations provides the\n[`gcloud workstations ssh`](/sdk/gcloud/reference/workstations/ssh)\ncommand, which establishes the TCP tunnel and runs an SSH client with a\nsingle `gcloud` CLI command.\n\nFor all other use cases, use the\n[`gcloud workstations start-tcp-tunnel`](/sdk/gcloud/reference/workstations/start-tcp-tunnel)\ncommand to establish the TCP tunnel and run the application that will use the\ntunnel (for example, `curl`) in a separate terminal.\n| **Note:** All preconfigured Cloud Workstations images include an SSH server that runs on workstation port `22`.\n\nBefore you begin\n----------------\n\n1. If you don't already have a workstation to connect to,\n [set up a workstation](/workstations/docs/quickstart-set-up-workstations-console).\n\n2.\n\n\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the `gcloud` CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n \u003cbr /\u003e\n\n3. Make sure that you have the\n [Cloud Workstations User](/workstations/docs/access-control#workstations-user)\n IAM role on the workstation you will connect to.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n\nConnect to your workstation using SSH\n-------------------------------------\n\nTo establish a secure SSH connection to your workstation, use the\n[`gcloud workstations ssh`](/sdk/gcloud/reference/workstations/ssh)\ncommand, which starts a TCP tunnel and runs an SSH client.\n\nTo copy the command to the copy-paste buffer, click\ncontent_copy\n**Copy code sample** and then paste the command into a local terminal window: \n\n gcloud workstations ssh \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --config=\u003cvar translate=\"no\"\u003eCONFIG_NAME\u003c/var\u003e \\\n --port=\u003cvar translate=\"no\"\u003eWORKSTATION_PORT\u003c/var\u003e \\\n --local-host-port=localhost:\u003cvar translate=\"no\"\u003eLOCAL_PORT\u003c/var\u003e \\\n \u003cvar translate=\"no\"\u003eWORKSTATION_NAME\u003c/var\u003e\n\nReplace the following values:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the Google Cloud project ID for the\n project containing the workstation. If omitted, the current project is\n used.\n\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region where the workstation's cluster is\n located---for example, `us-central1`.\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of the workstation cluster\n containing the workstation.\n\n- \u003cvar translate=\"no\"\u003eCONFIG_NAME\u003c/var\u003e: the name of the workstation configuration\n containing this workstations.\n\n- \u003cvar translate=\"no\"\u003eWORKSTATION_PORT\u003c/var\u003e (Optional): the port on the workstation\n to which traffic should be sent. If omitted, traffic will be sent to port\n `22`. All preconfigured Cloud Workstations images include an SSH server that runs\n on workstation port `22`.\n\n- \u003cvar translate=\"no\"\u003eLOCAL_PORT\u003c/var\u003e (Optional): the localhost port from which\n traffic will be sent. Valid port numbers are `1024` to `65535`. If you omit\n the `--local-host-port` flag or specify a port of `0` an unused port is\n selected automatically.\n\n- \u003cvar translate=\"no\"\u003eWORKSTATION_NAME\u003c/var\u003e: the name of the workstation.\n\nOptional: To pass flags and positionals to the underlying `ssh`\nimplementation, append them to the command after a double-dash (`--`).\n\nUse a TCP tunnel to forward arbitrary TCP traffic to your workstation\n---------------------------------------------------------------------\n\nTo connect to a workstation using a TCP application other than `ssh`, use the\n[`gcloud workstations start-tcp-tunnel`](https://cloud.google.com/sdk/gcloud/reference/workstations/start-tcp-tunnel)\ncommand:\n\n1. Run the following `gcloud` CLI command to create an authenticated\n TCP tunnel.\n\n To copy the command to the copy-paste buffer, click\n content_copy\n **Copy code sample** and then paste the command into a local terminal window: \n\n gcloud workstations start-tcp-tunnel \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --config=\u003cvar translate=\"no\"\u003eCONFIG_NAME\u003c/var\u003e \\\n --local-host-port=localhost:\u003cvar translate=\"no\"\u003eLOCAL_PORT\u003c/var\u003e \\\n \u003cvar translate=\"no\"\u003eWORKSTATION_NAME\u003c/var\u003e \\\n \u003cvar translate=\"no\"\u003eWORKSTATION_PORT\u003c/var\u003e\n\n Replace the following values:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the Google Cloud project ID for the\n project containing the workstation. If omitted, the current project is\n used.\n\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region where the workstation's cluster is\n located---for example, `us-central1`.\n\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of the workstation cluster\n containing the workstation.\n\n - \u003cvar translate=\"no\"\u003eCONFIG_NAME\u003c/var\u003e: the name of the workstation\n configuration containing this workstations.\n\n - \u003cvar translate=\"no\"\u003eLOCAL_PORT\u003c/var\u003e (Optional): the localhost port from which\n traffic will be sent. Valid port numbers are `1024` to `65535`. If you\n omit the `--local-host-port` flag or specify a port of `0` an unused\n port is selected automatically.\n\n - \u003cvar translate=\"no\"\u003eWORKSTATION_NAME\u003c/var\u003e: the name of the workstation.\n\n - \u003cvar translate=\"no\"\u003eWORKSTATION_PORT\u003c/var\u003e: the workstation port to which\n traffic should be sent.\n [Preconfigured Cloud Workstations images](/workstations/docs/preconfigured-base-images)\n include an SSH server that runs on workstation port `22`.\n\n2. The `gcloud` CLI command performs a connectivity test with the\n workstation, opens a tunnel, and then displays a port number:\n\n Listening on port [\u003cvar translate=\"no\"\u003eLOCAL_PORT\u003c/var\u003e].\n\n All traffic sent to `localhost:`\u003cvar translate=\"no\"\u003eLOCAL_PORT\u003c/var\u003e is forwarded to\n the workstation. The port is only accessible by applications running on your\n local computer.\n3. Leave the `gcloud` CLI running and open another terminal to run the\n application that connects to your workstation.\n\n For example, if you are running a server on your workstation that serves\n port \u003cvar translate=\"no\"\u003eWORKSTATION_PORT\u003c/var\u003e, and in the previous step you\n created a TCP tunnel that forwards traffic between your local port\n \u003cvar translate=\"no\"\u003eLOCAL_PORT\u003c/var\u003e and the workstation port\n \u003cvar translate=\"no\"\u003eWORKSTATION_PORT\u003c/var\u003e, you could run `curl` on your local\n machine to connect to the server on your workstation: \n\n curl localhost:\u003cvar translate=\"no\"\u003eLOCAL_PORT\u003c/var\u003e\n Hello, world!\n\n4. When you are finished, return to the terminal where you started the TCP\n tunnel and interrupt the `gcloud` CLI by pressing\n \u003ckbd\u003eControl+C\u003c/kbd\u003e.\n\nUse SSH servers on different ports\n----------------------------------\n\n[Custom container images](/workstations/docs/custom-container-images)\ncan also use SSH servers on any port. To support connections from the\n`gcloud` CLI tunnel, you must configure custom SSH servers to allow\npassword authentication and set the target user with an empty password.\nCloud Workstations uses\n[Cloud IAM](/iam/docs/overview)\nto help ensure that only authorized traffic is sent to the SSH server.\n\nWhat's next\n-----------\n\n- [Set container environment variables in SSH sessions](/workstations/docs/customize-container-images#container_image_that_sets_container_environment_variables_in_ssh_sessions) for custom container images\n- [Enable X11 forwarding](/workstations/docs/customize-container-images#container_image_that_enables_x11_forwarding_for_ssh_sessions) for custom container images"]]
