Download Latest Version containerssh_0.6.0_windows_amd64.zip (22.0 MB)
Email in envelope

Get an email when there's a new version of ContainerSSH

Home / v0.6.0
Name Modified Size InfoDownloads / Week
Parent folder
containerssh-authconfig-openapi.json 2026-03-23 361.6 kB
0
LICENSE 2026-03-23 10.2 kB
0
containerssh.cdx.sbom 2026-03-23 136.9 kB
0
containerssh_0.6.0_checksums.txt 2026-03-23 1.6 kB
1 1 weekly downloads
containerssh_0.6.0_checksums.txt.sig 2026-03-23 566 Bytes
0
containerssh_0.6.0_linux_amd64.deb 2026-03-23 21.4 MB
0
NOTICE.md 2026-03-23 16.1 kB
0
containerssh_0.6.0_linux_arm64.deb 2026-03-23 19.1 MB
0
containerssh-0.6.0-source.tar.gz 2026-03-23 338.6 kB
0
containerssh_0.6.0_linux_amd64.apk 2026-03-23 22.3 MB
0
containerssh_0.6.0_linux_amd64.rpm 2026-03-23 22.3 MB
0
containerssh_0.6.0_linux_arm64.apk 2026-03-23 19.8 MB
0
containerssh_0.6.0_linux_arm64.rpm 2026-03-23 19.8 MB
0
containerssh_0.6.0_darwin_amd64.tar.gz 2026-03-23 21.8 MB
0
containerssh_0.6.0_freebsd_arm64.tar.gz 2026-03-23 19.0 MB
0
containerssh_0.6.0_linux_amd64.tar.gz 2026-03-23 21.3 MB
0
containerssh_0.6.0_linux_arm64.tar.gz 2026-03-23 19.1 MB
0
containerssh_0.6.0_darwin_arm64.tar.gz 2026-03-23 20.0 MB
0
containerssh_0.6.0_freebsd_amd64.tar.gz 2026-03-23 21.3 MB
0
containerssh_0.6.0_windows_amd64.zip 2026-03-23 22.0 MB
1 1 weekly downloads
containerssh_0.6.0_windows_arm64.zip 2026-03-23 19.2 MB
0
README.md 2026-03-23 6.6 kB
0
v0.6.0 source code.tar.gz 2026-03-23 338.7 kB
0
v0.6.0 source code.zip 2026-03-23 539.0 kB
0
Totals: 24 Items   290.3 MB 2

This release introduces the persistent Kubernetes execution mode, extra scope support for OIDC authentication, important bug fixes for Kerberos and Docker image pulling, and a lot of dependency updates.

Summary

  1. Persistent Kubernetes execution mode
  2. OIDC extra scopes
  3. Kerberos authentication fixes
  4. Docker image pull policy fix

Persistent Kubernetes execution mode

A new persistent execution mode has been added to the Kubernetes backend. Unlike the existing connection mode which create a new pod for each SSH connection and terminates the pod after the session terminates, persistent mode execs into an already existing pod with an option to create the pod if it doesn't exist, or to simply refuse entry if it doesn't. This mode can be useful for use-cases where stateful sessions are needed, including but not limited to managing long-running interactive processes, resource sharing etc.

!!! warning "ContainerSSH cannot guarantee user isolation in this mode" It is expeced that the users of this feature will use the configuration server to ensure that every user is dropped into the correct pod, ideally unique per-user. Do not specify the pod to use in the global configuration as this will lead to all users to be sent to the same pod without any isolation. If this is combined with any type of credential forwarding it can lead to the users credentials being compromised.

In the simplest form the persistent mode can be configured with the following block:

:::yaml
kubernetes:
  pod:
    mode: persistent
    metadata:
      name: my-existing-pod
      namespace: default

With the createMissingPods option a minimal pod spec is also required:

:::yaml
kubernetes:
  pod:
    mode: persistent
    createMissingPods: true
    metadata:
      name: my-pod
      namespace: default
    spec:
      containers:

        - name: shell
          image: containerssh/containerssh-guest-image

Thanks to @gigabyte132 for contributing this feature.

Read more »{: .md-button}

OIDC extra scopes

The OIDC authentication provider now supports requesting additional scopes beyond the default openid scope.

Two new configuration options have been added for the oidc provider:

  • extraScopes: A list of additional OIDC scopes to request during authentication.

  • enforceScopes: When set to true, authentication will be rejected if the user does not grant all requested extra scopes.

    :::yaml auth: keyboardInteractive: method: oauth2 oauth2: provider: oidc oidc: url: https://your-oidc-server.example.com/ extraScopes:

          - profile
      - email
    enforceScopes: true

These options work with both the device flow and authorization code flow.

Thanks to @hashkrish for contributing this feature.

Read more »{: .md-button}

Kerberos authentication fixes

This release fixes two issues with Kerberos authentication:

  • enforceUsername=false now works correctly. Previously, disabling username enforcement would still reject valid logins with differing usernames.
  • Metadata merging is now additive. Kerberos authentication metadata is now correctly merged with existing connection metadata instead of replacing it. This ensures that metadata set by earlier authentication or configuration steps is preserved.

Thanks to @gigabyte132 for contributing this feature.

Docker image pull policy fix

The behavior of the IfNotPresent image pull policy has been corrected. Previously, images with no tag or the :latest tag were always pulled even when already present locally, which prevented using local images. The IfNotPresent policy now consistently skips pulling when the image is already available locally, regardless of the tag.

Thanks to @AlbertoPimpo for the fix

Full changelog:

Changelog

What's Changed

New Contributors

Source: README.md, updated 2026-03-23