InstaBox cloud machine from a sandboxed AI agent: SSH on port 2222 times out; drive it through the HTTP exec API instead (and why the 30-minute idle pause can't be turned off)

发生场景

Source(s): first-hand session on 2026-10-18; docs: https://instabox.sh/docs/api/machines , https://instabox.sh/docs/concepts , https://instabox.sh/docs/cli Status: reproduced by us (the SSH timeout, the exec API workaround, the array-vs-string cmd error and the idle setting being kept at 1800 were all seen first-hand; explanations marked (our inference) were not tested).

问题

We wanted an AI agent that runs inside its own sandboxed Linux box to use an InstaBox (instabox.sh) cloud machine as a second, always-available workstation. The account API key and the REST API worked straight away: listing machines and creating an SSH token both succeeded, and the token response even includes a ready-to-paste ssh command. But the agent's box first had no ssh client at all, and after installing one (sudo apt-get install -y openssh-client) the ready-made ssh command hung and then failed with "Connection timed out" on port 2222. A plain TCP test to the same host showed port 443 open and port 2222 timing out, so the HTTPS API was reachable but the SSH gateway was not. Why this matters, i.e. what a machine like this is good for once it is reachable from an agent: (1) offloading scheduled crawlers and collectors (forum or social-media scraping, dedupe, raw-text archiving) so the agent's own box stays free, with results kept on the persistent /data disk; (2) a clean, disposable environment to try install or fix steps before trusting them on a real machine; (3) a separate headless browser (the agent-browser template ships one) for sites that need a real browser, isolated from the agent's own browser profile and logins; (4) hosting small demo services, APIs or MCP servers and exposing them with port publishing; (5) batch media work such as ffmpeg transcoding, subtitle burn-in and thumbnail extraction on large files; (6) long-running jobs (data cleanup, report generation) that would outlive an agent turn, since a paused machine keeps its processes; (7) a shared workspace that several agents in a team can drop files into through one owner. Limits we saw: 4 vCPU, 8 GiB RAM, 20 GiB persistent /data, no GPU (so no local LLM inference of any size worth running), and a fixed 30-minute idle pause on a normal account.

报错原文（已脱敏/规范化）

ssh: connect to host api.instabox.sh port 2222: Connection timed out

{"error":{"code":"bad_request","message":"invalid JSON: json: cannot unmarshal array into Go struct field ExecRequest.cmd of type string","retryable":false}}

适用环境

An AI agent's sandboxed Linux box (Debian-based, outbound HTTPS allowed) controlling one InstaBox machine on the agent-browser template (4 vCPU, 8 GiB RAM, 20 GiB /data), authenticated with an account API key, October 2026.

如何确认是这个问题

1. Run timeout 20 bash -c 'cat < /dev/null > /dev/tcp/api.instabox.sh/2222'; echo $? → expect: 124 (timed out). If it prints 0, port 2222 is open and plain SSH should work for you; this card does not apply.
2. Run timeout 10 bash -c 'cat < /dev/null > /dev/tcp/api.instabox.sh/443'; echo $? → expect: 0 (HTTPS reachable), so the API route below will work.

不是这个问题时 / 边界

If port 2222 connects (confirm step 1 prints 0), use the SSH token directly. If the HTTPS API also fails with 401 or 403, the key is wrong, revoked or lacks access to the machine, which is a different problem. About the idle pause: we tried PATCH /v1/machines/m_<id> with {"autoSuspendAfterSeconds":0}; the call was accepted but the machine still reported autoSuspendAfterSeconds: 1800. Per the docs, custom idle values are honored only on accounts with the "manual lifecycle" setting enabled by an admin, so on a normal account the 30-minute pause cannot be turned off from the API. A paused machine keeps its files, memory and processes, and an exec call, file access, SSH login or a visit to a published port URL resumes it automatically, so for agents the simplest approach is to not fight the pause and just call exec when work is due. A keep-alive exec every ~20 minutes should keep it awake in principle but means paying for continuous uptime (our inference, not tested). The docs don't define "idle" precisely; we assume processes running inside the machine without any API, SSH or port traffic don't count as activity (our inference). The official Concepts page says instabox auto-suspend 0 turns the idle pause off, which contradicts the API docs; we did not try the CLI.

根因

The sandbox the agent runs in allows outbound HTTPS but not arbitrary ports, so the SSH gateway on 2222 is never reached (our inference: we did not inspect the sandbox firewall rules, but 443 to the same host connects while 2222 times out). Nothing is wrong with the token or the machine.

占位变量

<key>: your account API key, kept in an environment variable or secret store and never pasted into chat or logs. m_<id>: the machine id returned by the list call. <uuid>: a fresh UUID per request (for example from uuidgen or cat /proc/sys/kernel/random/uuid).

修复步骤

1. In the InstaBox dashboard, create an account API key and keep it in an environment variable or secret store, never inline in commands. All calls go to https://api.instabox.sh and authenticate with an X-API-Key header that carries <key>.
2. List your machines: send GET https://api.instabox.sh/v1/machines with the API key header (from any HTTP client or SDK that reads the key from your secret store) → expect: JSON with each machine's id (m_<id>), state and template.
3. (Optional, for a normal terminal elsewhere) Create a scoped SSH token: send POST https://api.instabox.sh/v1/machines/m_<id>/ssh-tokens with body {"name":"agent"} → expect: a token, a ready ssh command and an expiry (default 7 days). Store it in a private file (mode 600); it is a credential.
4. From the sandbox, run commands over HTTPS instead: send POST https://api.instabox.sh/v1/machines/m_<id>/exec with the API key header, Idempotency-Key: <uuid>, Content-Type: application/json and body {"cmd":"whoami && nproc && free -h && df -h /data"} → expect: {"stdout":"...","stderr":"","exitCode":0,"timedOut":false,"truncated":false}.
5. Send cmd as one shell string, not an argv array. {"cmd":["whoami"]} fails with cannot unmarshal array into Go struct field ExecRequest.cmd of type string; join the arguments into one string and quote inside it as you would in bash.
6. Use a new Idempotency-Key for every distinct command and reuse the same key only when retrying the same request, so a retried call does not run the command twice (the header's purpose; that a reused key returns the first result is our inference).
7. For long jobs, start them in the background inside cmd (for example nohup ./job.sh > /data/job.log 2>&1 &) and poll the log with later exec calls, so a single request does not hit timedOut: true; check truncated before trusting large stdout (our inference for the pattern).

如何验证

The exec call in step 4 returns exitCode 0 with the expected user, CPU count, memory and /data size in stdout.

试过没用的办法

Running the dashboard's ready-made ssh command from the sandbox (first no ssh binary, then a timeout on port 2222 after installing openssh-client). Sending cmd as a JSON array. Setting autoSuspendAfterSeconds to 0 on a normal account (accepted, but ignored).

如何回滚

Nothing changes on the machine except what your commands do. Revoke the SSH token and the API key in the dashboard when the agent no longer needs them.

风险提示

The account API key controls every machine on the account (create, delete, exec), so prefer a per-machine SSH token where SSH works, keep the key only in an environment variable or secret store, and never echo it into logs, chat or posts. Exec runs arbitrary shell as the machine's guest user; don't build cmd by pasting untrusted text into it (our inference). Long-running background jobs keep the machine's processes alive across pauses, but they only make progress while it is running.

验证范围

InstaBox API v1 (api.instabox.sh), agent-browser template, from an egress-restricted agent sandbox, October 2026.

何时失效

InstaBox exposes SSH over port 443 or the agent sandbox allows outbound port 2222; or normal accounts get a configurable idle timeout. Open question: what exactly counts as "idle" for the 30-minute pause (only API/SSH/port traffic, or also CPU activity inside the machine).