[GH-ISSUE #5996] SSH fails to connect via terminal and UI #11990

Open
opened 2026-08-05 01:32:01 -04:00 by saavagebueno · 2 comments
Owner

Originally created by @HariTrigger on GitHub (Apr 26, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5996

SSH server fails when NetBird client runs inside Docker container: /bin/login: no such file or directory

Describe the problem

When the NetBird client runs inside a Docker container with NB_ALLOW_SERVER_SSH=true and network_mode: host, the built-in SSH server authenticates successfully via JWT but immediately fails to start a shell. It attempts to execute /bin/login from within the container filesystem, which does not exist in the minimal NetBird Docker image.

The session connects, JWT auth is granted, but the shell never opens and the connection drops after ~2ms.

To Reproduce

  1. Run the NetBird client inside Docker with NB_ALLOW_SERVER_SSH=true and network_mode: host:
services:
  netbird-gateway:
    image: netbirdio/netbird:latest
    container_name: netbird-gw
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    environment:
      - NB_SETUP_KEY=<your-setup-key>
      - NB_MANAGEMENT_URL=https://<your-management-url>
      - NB_ALLOW_SERVER_SSH=true
    volumes:
      - netbird-data:/etc/netbird
volumes:
  netbird-data:
  1. Connect to the peer via the NetBird dashboard SSH feature (Peers → SSH button)
  2. JWT authentication succeeds
  3. Connection immediately drops with no shell

Expected behavior

SSH session should open a shell on the host system when the container uses network_mode: host. Since the container has full access to the host network stack, it should also be able to launch a host shell, or the image should include the necessary binaries (/bin/login, /bin/bash) to support SSH sessions.

Alternatively, the documentation and/or the NB_ALLOW_SERVER_SSH environment variable should clearly warn that this feature is not supported in Docker deployments.

Are you using NetBird Cloud?

Self-hosted NetBird control plane (version 0.69.0)

NetBird version

Client

0.69.0

Server Management

0.69.0

Dasboard

v2.37.1

Is any other VPN software installed?

No

Debug output

Container logs showing the failure:

2026-04-26T15:09:36.364Z INFO  [jwt_user: , session: user@100.69.69.97:63163] client/ssh/server/server.go:637: SSH auth granted via wildcard (index: 0)
2026-04-26T15:09:36.467Z INFO  [jwt_user: , session: user@100.69.69.97:63163-7ad1b225] client/ssh/server/session_handlers.go:44: SSH session started
2026-04-26T15:09:36.468Z INFO  [session: @100.69.69.97:63163-7ad1b225, jwt_user: ] client/ssh/server/command_execution_unix.go:184: starting interactive shell: /bin/login -f user -h 100.69.69.97 -p
2026-04-26T15:09:36.469Z ERRO  [jwt_user: , session: user@100.69.69.97:63163-7ad1b225] client/ssh/server/command_execution_unix.go:192: Pty start failed: start Pty: fork/exec /bin/login: no such file or directory
2026-04-26T15:09:36.470Z INFO  [session: user@100.69.69.97:63163-7ad1b225, jwt_user: ] client/ssh/server/session_handlers.go:53: SSH session closed after 3ms

Additional context

  • Platform: Raspberry Pi, linux/arm64, Debian 13
  • The container uses network_mode: host so it has full access to the host network stack
  • JWT authentication succeeds — the failure happens purely at shell execution time
  • The NetBird Docker image does not include /bin/login or any shell utilities
  • Mounting /bin/login from the host is a possible workaround but requires also mounting all dependent shared libraries (/lib, /lib64), which is impractical and insecure
  • This is reproducible 100% of the time when SSH is attempted against a Docker-based NetBird client

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @HariTrigger on GitHub (Apr 26, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5996 # SSH server fails when NetBird client runs inside Docker container: `/bin/login: no such file or directory` ## Describe the problem When the NetBird client runs inside a Docker container with `NB_ALLOW_SERVER_SSH=true` and `network_mode: host`, the built-in SSH server authenticates successfully via JWT but immediately fails to start a shell. It attempts to execute `/bin/login` from within the container filesystem, which does not exist in the minimal NetBird Docker image. The session connects, JWT auth is granted, but the shell never opens and the connection drops after ~2ms. ## To Reproduce 1. Run the NetBird client inside Docker with `NB_ALLOW_SERVER_SSH=true` and `network_mode: host`: ```yaml services: netbird-gateway: image: netbirdio/netbird:latest container_name: netbird-gw restart: unless-stopped network_mode: host cap_add: - NET_ADMIN - SYS_ADMIN environment: - NB_SETUP_KEY=<your-setup-key> - NB_MANAGEMENT_URL=https://<your-management-url> - NB_ALLOW_SERVER_SSH=true volumes: - netbird-data:/etc/netbird volumes: netbird-data: ``` 2. Connect to the peer via the NetBird dashboard SSH feature (Peers → SSH button) 3. JWT authentication succeeds 4. Connection immediately drops with no shell ## Expected behavior SSH session should open a shell on the host system when the container uses `network_mode: host`. Since the container has full access to the host network stack, it should also be able to launch a host shell, or the image should include the necessary binaries (`/bin/login`, `/bin/bash`) to support SSH sessions. Alternatively, the documentation and/or the `NB_ALLOW_SERVER_SSH` environment variable should clearly warn that this feature is not supported in Docker deployments. ## Are you using NetBird Cloud? Self-hosted NetBird control plane (version 0.69.0) ## NetBird version Client ``` 0.69.0 ``` Server Management ``` 0.69.0 ``` Dasboard ``` v2.37.1 ``` ## Is any other VPN software installed? No ## Debug output Container logs showing the failure: ``` 2026-04-26T15:09:36.364Z INFO [jwt_user: , session: user@100.69.69.97:63163] client/ssh/server/server.go:637: SSH auth granted via wildcard (index: 0) 2026-04-26T15:09:36.467Z INFO [jwt_user: , session: user@100.69.69.97:63163-7ad1b225] client/ssh/server/session_handlers.go:44: SSH session started 2026-04-26T15:09:36.468Z INFO [session: @100.69.69.97:63163-7ad1b225, jwt_user: ] client/ssh/server/command_execution_unix.go:184: starting interactive shell: /bin/login -f user -h 100.69.69.97 -p 2026-04-26T15:09:36.469Z ERRO [jwt_user: , session: user@100.69.69.97:63163-7ad1b225] client/ssh/server/command_execution_unix.go:192: Pty start failed: start Pty: fork/exec /bin/login: no such file or directory 2026-04-26T15:09:36.470Z INFO [session: user@100.69.69.97:63163-7ad1b225, jwt_user: ] client/ssh/server/session_handlers.go:53: SSH session closed after 3ms ``` ## Additional context - **Platform:** Raspberry Pi, `linux/arm64`, Debian 13 - The container uses `network_mode: host` so it has full access to the host network stack - JWT authentication **succeeds** — the failure happens purely at shell execution time - The NetBird Docker image does not include `/bin/login` or any shell utilities - Mounting `/bin/login` from the host is a possible workaround but requires also mounting all dependent shared libraries (`/lib`, `/lib64`), which is impractical and insecure - This is reproducible 100% of the time when SSH is attempted against a Docker-based NetBird client ## Have you tried these troubleshooting steps? - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the client label 2026-08-05 01:32:01 -04:00
Author
Owner

@lixmal commented on GitHub (Apr 26, 2026):

Can't reproduce your case: the image has /bin/login (symlink to busybox) and /bin/bash on arm64. However, even if this worked for you, you wouldn't land in the host's filesystem since that is still isolated.

What image are you actually running?

<!-- gh-comment-id:4322400157 --> @lixmal commented on GitHub (Apr 26, 2026): Can't reproduce your case: the image has `/bin/login` (symlink to busybox) and `/bin/bash` on arm64. However, even if this worked for you, you wouldn't land in the host's filesystem since that is still isolated. What image are you actually running?
Author
Owner

@HariTrigger commented on GitHub (Apr 26, 2026):

@lixmal I'm running netbirdio/netbird:latest

<!-- gh-comment-id:4322409431 --> @HariTrigger commented on GitHub (Apr 26, 2026): @lixmal I'm running netbirdio/netbird:latest
Sign in to join this conversation.
No Label client
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11990