SSH Container — Safe Remote Access & VS Code on TrueNAS

A safer alternative to enabling SSH directly on TrueNAS Scale, and a way to use VS Code as a full remote editor against your NAS data.

Overview

TrueNAS Scale’s system SSH daemon runs as root on the host OS, meaning any SSH access is privileged and directly touches the underlying system. Enabling it for day-to-day use is a security risk.

This guide sets up a dedicated Ubuntu SSH container that runs in Docker alongside your other stacks. It:

• Isolates SSH access to a container with a non-root user, keeping the TrueNAS host shell locked down
• Mounts only the data you need, rather than exposing the entire system
• Supports VS Code Remote-SSH, since TrueNAS’s musl-based shell can’t run the VS Code Server binary — the Ubuntu container provides a proper glibc environment

The result is a lightweight SSH gateway you can connect to from your laptop for file browsing, editing, and live access via VS Code, without touching the host.

Prerequisites

• TrueNAS Scale with Docker/Dockge running
• A private Docker registry (optional, but recommended for fast restarts)
• Your laptop’s SSH public key (~/.ssh/id_rsa.pub)

Step 1: Build the Docker Image

1.1 Create the build directory

On TrueNAS, create a folder for the build files:

mkdir -p /mnt/your-pool/configs/docker-builds/data-ssh
cd /mnt/your-pool/configs/docker-builds/data-ssh

1.2 Create the Dockerfile

FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -q && \
    apt-get install -y -q openssh-server && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* && \
    mkdir -p /run/sshd && \
    groupadd -g 568 truenas-data && \
    useradd -m -u 1001 -s /bin/bash <your-username> && \
    usermod -aG root <your-username> && \
    usermod -aG 568 <your-username> && \
    echo 'AllowTcpForwarding yes' >> /etc/ssh/sshd_config

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 22
CMD ["/entrypoint.sh"]

Note: Adjust the GID 568 and UID 1001 to match your TrueNAS dataset ownership. Check with ls -la /mnt/your-pool/ to see the UIDs/GIDs in use.

1.3 Create the entrypoint script

#!/bin/bash
mkdir -p /home/<your-username>/.ssh
echo "$PUBLIC_KEY" > /home/<your-username>/.ssh/authorized_keys
chown -R <your-username>:<your-username> /home/<your-username>/.ssh
chmod 700 /home/<your-username>/.ssh
chmod 600 /home/<your-username>/.ssh/authorized_keys
exec /usr/sbin/sshd -D

Save this as entrypoint.sh in the same directory.

1.4 Build and push the image

sudo docker build -t <truenas-ip>:<registry-port>/data-ssh:latest .
sudo docker push <truenas-ip>:<registry-port>/data-ssh:latest

Replace <truenas-ip>:<registry-port> with your own registry address, or use data-ssh:latest if you don’t have a private registry.

Step 2: Deploy with Dockge

2.1 Create the Compose file

In Dockge, create a new stack called data-ssh with the following:

services:
  data-ssh:
    image: <truenas-ip>:<registry-port>/data-ssh:latest
    environment:
      - PUBLIC_KEY=${SSH_PUBLIC_KEY}
    volumes:
      - ${DATA_PATH}:/data
    ports:
      - "2222:22"
    restart: unless-stopped

2.2 Set environment variables

In Dockge’s env section (or a .env file):

SSH_PUBLIC_KEY=ssh-rsa AAAA...your-public-key-here...
DATA_PATH=/mnt/your-pool/data

Get your public key with:

cat ~/.ssh/id_rsa.pub

2.3 Start the stack

Deploy the stack in Dockge. The container should start in seconds since the image is pre-built.

Step 3: Configure SSH on Your Laptop

Add this to ~/.ssh/config:

Host truenas-data
  HostName <truenas-ip>
  Port 2222
  User <your-username>
  IdentityFile ~/.ssh/id_rsa

Test the connection:

ssh truenas-data

Accept the host key fingerprint when prompted.

Step 4: Connect with VS Code Remote-SSH

1. Install the Remote - SSH extension in VS Code
2. Open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P)
3. Run Remote-SSH: Connect to Host
4. Select truenas-data
5. VS Code will install its server inside the container and connect
6. Use File > Open Folder and navigate to /data

Troubleshooting

Connection refused

Check the container is running and sshd is listening:

sudo docker ps | grep data-ssh
sudo docker exec <container-name> ss -tlnp

Host key has changed error

Remove the stale key on your laptop:

ssh-keygen -R [<truenas-ip>]:2222

VS Code port forwarding disabled

Verify AllowTcpForwarding yes is in the container’s sshd_config:

sudo docker exec <container-name> grep AllowTcpForwarding /etc/ssh/sshd_config

Folders appear empty in VS Code

The VS Code server may have started before a group change took effect. Kill it to force a restart:

sudo docker exec <container-name> pkill -f vscode-server

Then reconnect in VS Code.

Permission denied on certain folders

Check folder ownership:

sudo docker exec <container-name> ls -la /data

If folders are owned by a GID not assigned to <your-username>, add the group:

sudo docker exec <container-name> groupadd -g <GID> extra-group
sudo docker exec <container-name> usermod -aG <GID> <your-username>
sudo docker exec <container-name> pkill -f vscode-server

Then rebuild the image with the new group baked in for persistence.

Rebuilding the Image

After any changes to the Dockerfile or entrypoint:

cd /mnt/your-pool/configs/docker-builds/data-ssh
sudo docker build -t <truenas-ip>:<registry-port>/data-ssh:latest .
sudo docker push <truenas-ip>:<registry-port>/data-ssh:latest

Then restart the stack in Dockge to pull the new image.