Remote SSH to Alpine Linux devices

Alpine is small, so a few packages come first. Then the device dials out and you open a shell from the browser.

What we test

Our device matrix runs Alpine 3.20 on amd64 and arm64, and boots Alpine armv7 in a full QEMU machine for 32-bit ARM. Each run installs, registers, opens a shell through the relay, updates, rolls back and uninstalls. Only the QEMU run boots OpenRC; the containers start the agent from an init script.

Before you install

apk add openssh openssl curl ca-certificates
rc-update add sshd default
rc-service sshd start

• OpenSSH only. Dropbear, common on small images, is not supported: sessions need the OpenSSH server.
• OpenSSL 3 lets the installer check the release signature. Without it, pass --sha256.

Install

Create a token in the dashboard, then run this as root:

curl -fsSL https://releases.rescueshell.com/latest/install.sh | sh -s -- \
  --base-url https://releases.rescueshell.com/latest --relay https://app.rescueshell.com \
  --name pump-07 --trust-keys-from pi

Change pi to the account you log in as. The device trusts the keys in that account's ~/.ssh/authorized_keys, and our servers cannot add one. See add a device for the other options.

What it sets up

• When OpenRC is running: an OpenRC service, /etc/init.d/rescueshell-agent, in the default runlevel.
• Logs go to /var/log/rescueshell-agent.log. rc-service rescueshell-agent status shows if it runs.
• One sshd drop-in in /etc/ssh/sshd_config.d/. Your main sshd_config is not edited.

No OpenRC, just BusyBox init? See Buildroot and BusyBox init. €0.10 a device a month, billed yearly, at least €6 a year.