Cloud Dev Sandbox (Ubuntu Ngrok SSH) Môi Trường Sandbox Đám Mây (Ubuntu Ngrok SSH)

1. 🎯 The Engineering Problem

Developers frequently need isolated, ephemeral Linux environments to test builds, reproduce CI/CD bugs, or execute resource-intensive CLI tasks. However:

1. Inbound Port Blocking on Modern PaaS: Modern container platforms (Railway, Render, Koyeb, Fly.io) expose only HTTP/HTTPS egress ports by default. Direct inbound SSH traffic on port 22 is blocked behind strict Carrier-Grade NAT (CGNAT) and firewall layers.
2. Dedicated Cloud VPS Expense: Renting dedicated cloud VMs with static public IPv4 addresses for brief 15-minute diagnostic tasks incurs unnecessary recurring hosting costs.
3. Complex Tunnel Setup: Manually logging into a web console, configuring reverse proxies, and transferring SSH keys slows down fast debugging iterations.

Ubuntu Ngrok SSH automates the entire lifecycle: launching a containerized Ubuntu 22.04 environment that establishes a secure Ngrok TCP reverse tunnel at boot, streaming the connection string directly to the container console.

---

2. 🏗️ Reverse Tunneling Architecture

flowchart LR
    DevTerminal["Local Developer Terminal\n(ssh user@0.tcp.ngrok.io -p 12345)"] -->|Encrypted SSH Connection| NgrokEdge["Ngrok Global Edge Server\n(Public TCP Relay)"]
    
    subgraph CloudPaaS ["Ephemeral Container Host (Railway / Render / Docker VPS)"]
        NgrokEdge -->|"Secure Outbound Reverse Tunnel (Port 443)"| NgrokAgent["Ngrok Tunnel Agent"]
        NgrokAgent -->|Forward to Local Port 22| SSHDaemon["OpenSSH Server (sshd)"]
        SSHDaemon --> Shell["Isolated Ubuntu 22.04 Sandbox"]
    end

---

3. ⚙️ Key Technical Decisions

• Outbound Reverse Tunneling: Because container platforms allow arbitrary outbound HTTPS traffic, Ngrok initiates an outbound tunnel back to Ngrok edge relays. This completely bypasses container NAT restrictions and firewalls without requiring a public IPv4 address.
• Automated Daemon Supervisor (entrypoint.sh): A lightweight bash supervisor boots sshd, executes ngrok tcp 22, queries Ngrok’s local API (http://127.0.0.1:4040/api/tunnels) to extract the dynamic public TCP URL, and logs the formatted ssh command directly to stdout.
• Clean Signal Handling & Non-Root Access: Traps SIGTERM and SIGINT to gracefully shut down background daemons, ensuring zero zombie processes upon container shutdown.

---

4. 💻 Core Implementation Highlights

#!/bin/bash
set -e

echo "[INIT] Starting OpenSSH Server..."
service ssh start

if [ -n "$NGROK_AUTH_TOKEN" ]; then
    echo "[INIT] Authenticating Ngrok Token..."
    ngrok config add-authtoken "$NGROK_AUTH_TOKEN" > /dev/null 2>&1

    echo "[INIT] Establishing Reverse TCP Tunnel on Port 22..."
    ngrok tcp 22 --log=stdout > /dev/null &
    
    # Wait for Ngrok local API to initialize
    sleep 3

    # Query dynamic public endpoint
    TUNNEL_URL=$(curl -s http://127.0.0.1:4040/api/tunnels | grep -o 'tcp://[^"]*' | sed 's/tcp:\/\///')
    
    if [ -n "$TUNNEL_URL" ]; then
        HOST=$(echo "$TUNNEL_URL" | cut -d':' -f1)
        PORT=$(echo "$TUNNEL_URL" | cut -d':' -f2)
        echo "=================================================="
        echo " 🚀 SSH TUNNEL READY!"
        echo " Connect with: ssh root@$HOST -p $PORT"
        echo "=================================================="
    fi
else
    echo "[WARN] NGROK_AUTH_TOKEN not provided. Tunneling disabled."
fi

# Keep container alive and forward signals
exec tail -f /dev/null

---

5. 📊 Results & Developer Utility

• Instant Terminal Access in < 15 Seconds: Container boots and outputs the SSH command within seconds of deployment.
• Zero Public IP Costs: Runs seamlessly on free or low-tier ephemeral container platforms without paying for dedicated IPv4 allocations.
• Complete Isolation: Provides a throwaway Linux environment for testing dangerous scripts and builds.

flowchart LR
    DevTerminal["Màn Hình Terminal Của Bạn\n(ssh user@0.tcp.ngrok.io -p 12345)"] -->|Kết Nối SSH Đã Mã Hóa| NgrokEdge["Máy Chủ Trung Gian Ngrok Edge\n(Public TCP Relay)"]
    
    subgraph CloudPaaS ["Hạ Tầng Container Đám Mây (Railway / Render / Docker VPS)"]
        NgrokEdge -->|"Đường Hầm Chiều Ra Outbound (Cổng 443)"| NgrokAgent["Tiến Trình Ngrok Agent"]
        NgrokAgent -->|Chuyển Tiếp Tới Cổng Nội Bộ 22| SSHDaemon["Dịch Vụ OpenSSH (sshd)"]
        SSHDaemon --> Shell["Môi Trường Ubuntu 22.04 Cô Lập"]
    end

#!/bin/bash
set -e

echo "[INIT] Đang khởi động dịch vụ OpenSSH..."
service ssh start

if [ -n "$NGROK_AUTH_TOKEN" ]; then
    echo "[INIT] Xác thực Token Ngrok..."
    ngrok config add-authtoken "$NGROK_AUTH_TOKEN" > /dev/null 2>&1

    echo "[INIT] Thiết lập đường hầm TCP đảo ngược cho cổng 22..."
    ngrok tcp 22 --log=stdout > /dev/null &
    
    # Chờ API cục bộ của Ngrok sẵn sàng
    sleep 3

    # Truy vấn lấy endpoint công khai động
    TUNNEL_URL=$(curl -s http://127.0.0.1:4040/api/tunnels | grep -o 'tcp://[^"]*' | sed 's/tcp:\/\///')
    
    if [ -n "$TUNNEL_URL" ]; then
        HOST=$(echo "$TUNNEL_URL" | cut -d':' -f1)
        PORT=$(echo "$TUNNEL_URL" | cut -d':' -f2)
        echo "=================================================="
        echo " 🚀 ĐƯỜNG HẦM SSH ĐÃ SẴN SÀNG!"
        echo " Kết nối ngay: ssh root@$HOST -p $PORT"
        echo "=================================================="
    fi
else
    echo "[CẢNH BÁO] Chưa cung cấp NGROK_AUTH_TOKEN."
fi

# Giữ container hoạt động liên tục
exec tail -f /dev/null