How to connect to virtual machines in Nebius AI Cloud

Safe connection to the VM over SSH uses a key pair: you place the public key on the VM and store the private key on your device.

Prerequisites

CLI
Go SDK
Python SDK
JavaScript SDK

Install and configure the Nebius AI Cloud CLI.

Set up the VM

To be able to connect to the VM, define specific information during the VM creation.

Generate a key pair

Generate an SSH key pair. You will need the contents of the public key and the path to your private key in later steps.

Configure the user data

User configuration helps to quickly create VMs with identical user data: it stores your username and the public key for the access to the VM.

CLI
Go SDK
Python SDK
JavaScript SDK

Create a configuration in the cloud-init format:

export USER_DATA=$(jq -Rrs '.' <<EOF
#cloud-config
users:
  - name: $USER
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ssh_authorized_keys:
      - $(cat ~/.ssh/id_ed25519.pub)
EOF
)

The configuration contains the following parameters:

name: Username for connecting to the VM. The above example sets the value of the machine’s USER environment variable as the username for the VM. Do not use the root or admin usernames. They are reserved for internal needs and are not allowed to connect to a VM by SSH.
sudo: Sudo policy. ALL=(ALL) NOPASSWD:ALL allows users unrestricted sudo access; False disables sudo access for users.
shell: Default shell.
ssh_authorized_keys: User’s authorized keys. Allows configuring SSH access to the VM. To create the key pair, follow the instructions in Generating SSH keys.

You can specify several users and their public SSH keys.For more information, see cloud-init configuration examples.

Define userData as a string in the cloud-init format:

publicKeyBytes, err := os.ReadFile(
    os.ExpandEnv("$HOME/.ssh/id_ed25519.pub"),
)
if err != nil {
    return err
}
publicKey := strings.TrimSpace(string(publicKeyBytes))
userData := "#cloud-config\nusers:\n" +
    "  - name: user\n" +
    "    sudo: ALL=(ALL) NOPASSWD:ALL\n" +
    "    shell: /bin/bash\n" +
    "    ssh_authorized_keys:\n" +
    "      - " + publicKey

The configuration contains the following parameters:

name: Username for connecting to the VM. The example sets user; replace it with your username. Do not use the root or admin usernames. They are reserved for internal needs and are not allowed to connect to a VM by SSH.
sudo: Sudo policy. ALL=(ALL) NOPASSWD:ALL allows users unrestricted sudo access; False disables sudo access for users.
shell: Default shell.
ssh_authorized_keys: User’s authorized keys. Allows configuring SSH access to the VM. To create the key pair, follow the instructions in Generating SSH keys.

You can specify several users and their public SSH keys.For more information, see cloud-init configuration examples.Pass userData to InstanceSpec.CloudInitUserData when you create the VM.

Define user_data as a string in the cloud-init format:

public_key = (
    Path.home()
    .joinpath(".ssh/id_ed25519.pub")
    .read_text()
    .strip()
)
user_data = "\n".join(
    [
        "#cloud-config",
        "users:",
        "  - name: user",
        "    sudo: ALL=(ALL) NOPASSWD:ALL",
        "    shell: /bin/bash",
        "    ssh_authorized_keys:",
        f"      - {public_key}",
    ],
)

The configuration contains the following parameters:

name: Username for connecting to the VM. The example sets user; replace it with your username. Do not use the root or admin usernames. They are reserved for internal needs and are not allowed to connect to a VM by SSH.
sudo: Sudo policy. ALL=(ALL) NOPASSWD:ALL allows users unrestricted sudo access; False disables sudo access for users.
shell: Default shell.
ssh_authorized_keys: User’s authorized keys. Allows configuring SSH access to the VM. To create the key pair, follow the instructions in Generating SSH keys.

You can specify several users and their public SSH keys.For more information, see cloud-init configuration examples.Pass user_data to InstanceSpec.cloud_init_user_data when you create the VM.

Define userData as a string in the cloud-init format:

const publicKey = readFileSync(
  `${process.env.HOME}/.ssh/id_ed25519.pub`,
  "utf8",
).trim();
const userData = [
  "#cloud-config",
  "users:",
  "  - name: user",
  "    sudo: ALL=(ALL) NOPASSWD:ALL",
  "    shell: /bin/bash",
  "    ssh_authorized_keys:",
  `      - ${publicKey}`,
].join("\n");

The configuration contains the following parameters:

name: Username for connecting to the VM. The example sets user; replace it with your username. Do not use the root or admin usernames. They are reserved for internal needs and are not allowed to connect to a VM by SSH.
sudo: Sudo policy. ALL=(ALL) NOPASSWD:ALL allows users unrestricted sudo access; False disables sudo access for users.
shell: Default shell.
ssh_authorized_keys: User’s authorized keys. Allows configuring SSH access to the VM. To create the key pair, follow the instructions in Generating SSH keys.

You can specify several users and their public SSH keys.For more information, see cloud-init configuration examples.Pass userData to InstanceSpec.cloudInitUserData when you create the VM.

Configure the VM

When you create the VM, specify the user data, network settings and boot disk:

CLI
Go SDK
Python SDK
JavaScript SDK

In the nebius compute instance create command, set the following parameters:

--cloud-init-user-data: Pass the user data with your username and public key.
--network-interfaces: To enable public access to the VM, include "public_ip_address": {} in the network interface specification. Alternatively, to enable public access to the VM, set "public_ip_address": {"allocation_id": "<allocation_ID>"} with an allocation ID. This way the public IP address is preserved as an allocation object and you can reuse it for another VM after deleting this one.

How to create an allocation

Get the default subnet’s ID:

export SUBNET_ID=$(nebius vpc subnet list \
  --format json \
  | jq -r ".items[0].metadata.id")

Create an allocation by using the default subnet’s ID:

export ALLOCATION_ID=$(nebius vpc allocation create \
  --ipv4-public-subnet-id $SUBNET_ID \
  --name allocation-name \
  --format json \
  | jq -r ".metadata.id")

If an allocation with a public address has not been assigned to any resource for 30 days, Nebius AI Cloud can delete this allocation and release its address. If you want to preserve the address, assign its allocation to a Nebius AI Cloud resource.

Example:

nebius compute instance create \
  --name inference-vm \
  --resources-platform <platform> \
  --resources-preset <preset> \
  --boot-disk-existing-disk-id <boot_disk_ID> \
  --boot-disk-attach-mode READ_WRITE \
  --cloud-init-user-data "$USER_DATA" \
  --network-interfaces '[{"name": "eth0", "subnet_id": "<subnet_ID>", "ip_address": {}, "public_ip_address": {"allocation_id": "<allocation_ID>"}}]'

Get the subnet ID:

subnets, err := sdk.Services().VPC().V1().
    Subnet().List(
        ctx,
        &vpc.ListSubnetsRequest{},
    )
if err != nil {
    return err
}
if len(subnets.GetItems()) == 0 {
    return errors.New("no subnets found")
}
subnetID := subnets.GetItems()[0].GetMetadata().GetId()

Create a public allocation:

allocationOperation, err := sdk.Services().VPC().V1().
    Allocation().Create(
        ctx,
        &vpc.CreateAllocationRequest{
            Metadata: &common.ResourceMetadata{
                Name: "allocation-name",
            },
            Spec: &vpc.AllocationSpec{
                IpSpec: &vpc.AllocationSpec_Ipv4Public{
                    Ipv4Public: &vpc.IPv4PublicAllocationSpec{
                        Pool: &vpc.IPv4PublicAllocationSpec_SubnetId{
                            SubnetId: subnetID,
                        },
                    },
                },
            },
        },
    )
if err != nil {
    return err
}
if _, err = allocationOperation.Wait(ctx); err != nil {
    return err
}
allocationID := allocationOperation.ResourceID()

Set the platform, preset, existing boot disk ID and cloud-init user data:

publicAllocation := &compute.PublicIPAddress_AllocationId{
    AllocationId: allocationID,
}
instanceOperation, err := sdk.Services().Compute().V1().
    Instance().Create(
        ctx,
        &compute.CreateInstanceRequest{
            Metadata: &common.ResourceMetadata{
                Name: "inference-vm",
            },
            Spec: &compute.InstanceSpec{
                Resources: &compute.ResourcesSpec{
                    Platform: "<platform>",
                    Size: &compute.ResourcesSpec_Preset{
                        Preset: "<preset>",
                    },
                },
                BootDisk: &compute.AttachedDiskSpec{
                    AttachMode: compute.AttachedDiskSpec_READ_WRITE,
                    Type: &compute.AttachedDiskSpec_ExistingDisk{
                        ExistingDisk: &compute.ExistingDisk{
                            Id: "<boot_disk_ID>",
                        },
                    },
                },
                CloudInitUserData: userData,
                NetworkInterfaces: []*compute.NetworkInterfaceSpec{
                    {
                        Name:      "eth0",
                        SubnetId:  subnetID,
                        IpAddress: &compute.IPAddress{},
                        PublicIpAddress: &compute.PublicIPAddress{
                            Allocation: publicAllocation,
                        },
                    },
                },
            },
        },
    )
if err != nil {
    return err
}
if _, err = instanceOperation.Wait(ctx); err != nil {
    return err
}

Get the subnet ID:

subnet_service = SubnetServiceClient(sdk)
subnets = await subnet_service.list(ListSubnetsRequest())
if not subnets.items:
    raise ValueError("no subnets found")
subnet_id = subnets.items[0].metadata.id

Create a public allocation:

allocation_service = AllocationServiceClient(sdk)
allocation_operation = await allocation_service.create(
    CreateAllocationRequest(
        metadata=ResourceMetadata(name="allocation-name"),
        spec=AllocationSpec(
            ipv4_public=IPv4PublicAllocationSpec(
                subnet_id=subnet_id,
            ),
        ),
    ),
)
await allocation_operation.wait()
allocation_id = allocation_operation.resource_id

Set the platform, preset, existing boot disk ID and cloud-init user data:

instance_service = InstanceServiceClient(sdk)
create_instance_operation = await instance_service.create(
    CreateInstanceRequest(
        metadata=ResourceMetadata(name="inference-vm"),
        spec=InstanceSpec(
            resources=ResourcesSpec(
                platform="<platform>",
                preset="<preset>",
            ),
            boot_disk=AttachedDiskSpec(
                attach_mode=AttachedDiskSpec.AttachMode.READ_WRITE,
                existing_disk=ExistingDisk(id="<boot_disk_ID>"),
            ),
            cloud_init_user_data=user_data,
            network_interfaces=[
                NetworkInterfaceSpec(
                    name="eth0",
                    subnet_id=subnet_id,
                    ip_address=IPAddress(),
                    public_ip_address=PublicIPAddress(
                        allocation_id=allocation_id,
                    ),
                ),
            ],
        ),
    ),
)
await create_instance_operation.wait()

Get the subnet ID:

const subnetService = new SubnetService(sdk);
const subnets = await subnetService.list(
  ListSubnetsRequest.create({}),
);
const subnetId = subnets.items[0]?.metadata?.id;
if (!subnetId) {
  throw new Error("no subnets found");
}

Create a public allocation:

const allocationService = new AllocationService(sdk);
const allocationOperation = await allocationService.create(
  CreateAllocationRequest.create({
    metadata: ResourceMetadata.create({
      name: "allocation-name",
    }),
    spec: AllocationSpec.create({
      ipSpec: {
        $case: "ipv4Public",
        ipv4Public: IPv4PublicAllocationSpec.create({
          pool: {
            $case: "subnetId",
            subnetId,
          },
        }),
      },
    }),
  }),
).result;
await allocationOperation.wait();
const allocationId = allocationOperation.resourceId();

Set the platform, preset, existing boot disk ID and cloud-init user data:

const connectInstanceService = new InstanceService(sdk);
const connectInstanceOperation = await connectInstanceService.create(
  CreateInstanceRequest.create({
    metadata: ResourceMetadata.create({
      name: "inference-vm",
    }),
    spec: InstanceSpec.create({
      resources: ResourcesSpec.create({
        platform: "<platform>",
        size: {
          $case: "preset",
          preset: "<preset>",
        },
      }),
      bootDisk: AttachedDiskSpec.create({
        attachMode: AttachedDiskSpec_AttachMode.READ_WRITE,
        type: {
          $case: "existingDisk",
          existingDisk: ExistingDisk.create({
            id: "<boot_disk_ID>",
          }),
        },
      }),
      cloudInitUserData: userData,
      networkInterfaces: [
        NetworkInterfaceSpec.create({
          name: "eth0",
          subnetId,
          ipAddress: IPAddress.create({}),
          publicIpAddress: PublicIPAddress.create({
            allocation: {
              $case: "allocationId",
              allocationId,
            },
          }),
        }),
      ],
    }),
  }),
).result;
await connectInstanceOperation.wait();

For the full set of parameters and more examples, see How to create a virtual machine in Nebius AI Cloud.

Connect to the VM by using SSH

Requirements to connect to a private IP address or FQDNTo connect to a VM from another VM by using a private IP address or an FQDN, both VMs must be in the same network.

Get your VM’s IP address:

Connecting from the internet
Connecting from another VM

To connect to the VM from the internet (if you have enabled public access to it), get its public IP address:

CLI
Go SDK
Python SDK
JavaScript SDK

export PUBLIC_IP_ADDRESS=$(nebius compute instance get-by-name \
  --name <VM_name> \
  --format json \
  | jq -r '.status.network_interfaces[0].public_ip_address.address | split("/")[0]')

publicInstance, err := sdk.Services().Compute().V1().
    Instance().GetByName(
        ctx,
        &common.GetByNameRequest{
            Name: "<VM_name>",
        },
    )
if err != nil {
    return err
}
publicAddress := publicInstance.GetStatus().
    GetNetworkInterfaces()[0].GetPublicIpAddress().GetAddress()
publicIPAddress := strings.Split(publicAddress, "/")[0]
if publicIPAddress == "" {
    return fmt.Errorf("public IP address is missing")
}

public_ip_service = InstanceServiceClient(sdk)
public_instance = await public_ip_service.get_by_name(
    GetByNameRequest(name="<VM_name>"),
)
public_address = (
    public_instance.status.network_interfaces[0]
    .public_ip_address.address
)
public_ip_address = public_address.split("/")[0]

const publicIpInstanceService = new InstanceService(sdk);
const publicIpInstance = await publicIpInstanceService.getByName(
  GetByNameRequest.create({
    name: "<VM_name>",
  }),
);
const publicAddress = publicIpInstance.status
  ?.networkInterfaces[0]?.publicIpAddress?.address;
let publicIpAddress = publicAddress?.split("/")[0];

To connect to the VM from another Compute VM, get the private IP address or FQDN of the VM that you connect to:

CLI
Go SDK
Python SDK
JavaScript SDK

Private IP address:

nebius compute instance get-by-name \
  --name <VM_name> \
  --format json \
  | jq -r '.status.network_interfaces[0].ip_address.address | split("/")[0]'

FQDN:

nebius compute instance get-by-name \
  --name <VM_name> \
  --format json \
  | jq -r '.status.network_interfaces[0].fqdn | split("/")[0]'

Private IP address:

privateInstance, err := sdk.Services().Compute().V1().
    Instance().GetByName(
        ctx,
        &common.GetByNameRequest{
            Name: "<VM_name>",
        },
    )
if err != nil {
    return err
}
privateAddress := privateInstance.GetStatus().
    GetNetworkInterfaces()[0].GetIpAddress().GetAddress()
fmt.Println(strings.Split(privateAddress, "/")[0])

FQDN:

fqdnInstance, err := sdk.Services().Compute().V1().
    Instance().GetByName(
        ctx,
        &common.GetByNameRequest{
            Name: "<VM_name>",
        },
    )
if err != nil {
    return err
}
fqdn := fqdnInstance.GetStatus().GetNetworkInterfaces()[0].GetFqdn()
fmt.Println(strings.Split(fqdn, "/")[0])

Private IP address:

private_ip_service = InstanceServiceClient(sdk)
private_instance = await private_ip_service.get_by_name(
    GetByNameRequest(name="<VM_name>"),
)
private_address = (
    private_instance.status.network_interfaces[0]
    .ip_address.address
)
print(private_address.split("/")[0])

FQDN:

fqdn_service = InstanceServiceClient(sdk)
fqdn_instance = await fqdn_service.get_by_name(
    GetByNameRequest(name="<VM_name>"),
)
fqdn = fqdn_instance.status.network_interfaces[0].fqdn
print(fqdn.split("/")[0])

Private IP address:

const privateIpInstanceService = new InstanceService(sdk);
const privateIpInstance = await privateIpInstanceService.getByName(
  GetByNameRequest.create({
    name: "<VM_name>",
  }),
);
const privateAddress = privateIpInstance.status
  ?.networkInterfaces[0]?.ipAddress?.address;
console.log(privateAddress?.split("/")[0]);

FQDN:

const fqdnInstanceService = new InstanceService(sdk);
const fqdnInstance = await fqdnInstanceService.getByName(
  GetByNameRequest.create({
    name: "<VM_name>",
  }),
);
const fqdn = fqdnInstance.status?.networkInterfaces[0]?.fqdn;
console.log(fqdn?.split("/")[0]);

Connect to the VM:
- Connecting from the internet
- Connecting from another VM
ssh <username>@<public_IP_address>
If your private key is stored in a custom location, specify the path to it with the -i parameter:
ssh -i ~/.ssh/<private_key_file> <username>@<public_IP_address>
Use the received private address or FQDN:
ssh <username>@<private_address_or_FQDN>
If your private key is stored in a custom location, specify the path to it with the -i parameter:
ssh -i ~/.ssh/<private_key_file> <username>@<private_address_or_FQDN>

Shared access to the VM

To let the other users connect to your VM:

Ask them to generate an SSH key pair and share the contents of their public key with you.
Connect to the VM under the name used when creating the VM:
ssh <username>@<public_IP_address>

Create a new user for VM access, named newuser in this example:

sudo useradd -m -d /home/newuser -s /bin/bash newuser

Switch to the new user:
sudo su - newuser
Create the ssh directory:
mkdir .ssh
In the directory, create the authorized_keys file:
cd .ssh touch authorized_keys

Add the new user’s public key to the created file:

echo "<public_key>" > /home/newuser/.ssh/authorized_keys

Change the directory’s access permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Exit the new user’s shell:
exit
Restart the VM:
sudo reboot
Ask the other user to check the connection:
ssh newuser@<public_IP_address>

Example

Example of getting the public IP address of the VM named training-instance and connecting to it from the internet:

CLI
Go SDK
Python SDK
JavaScript SDK

export PUBLIC_IP_ADDRESS=$(nebius compute instance get-by-name \
  --name training-instance \
  --format json \
  | jq -r '.status.network_interfaces[0].public_ip_address.address | split("/")[0]')
ssh $USER@$PUBLIC_IP_ADDRESS

trainingInstance, err := sdk.Services().Compute().V1().
    Instance().GetByName(
        ctx,
        &common.GetByNameRequest{
            Name: "training-instance",
        },
    )
if err != nil {
    return err
}
trainingAddress := trainingInstance.GetStatus().
    GetNetworkInterfaces()[0].GetPublicIpAddress().GetAddress()
publicIPAddress = strings.Split(trainingAddress, "/")[0]
fmt.Printf("ssh user@%s\n", publicIPAddress)

training_ip_service = InstanceServiceClient(sdk)
training_instance = await training_ip_service.get_by_name(
    GetByNameRequest(name="training-instance"),
)
training_address = (
    training_instance.status.network_interfaces[0]
    .public_ip_address.address
)
public_ip_address = training_address.split("/")[0]
print(f"ssh user@{public_ip_address}")

const trainingInstanceService = new InstanceService(sdk);
const trainingInstance = await trainingInstanceService.getByName(
  GetByNameRequest.create({
    name: "training-instance",
  }),
);
const trainingAddress = trainingInstance.status
  ?.networkInterfaces[0]?.publicIpAddress?.address;
publicIpAddress = trainingAddress?.split("/")[0];
console.log(`ssh user@${publicIpAddress}`);

Virtual machines

Slurm and Soperator in Nebius AI Cloud

Managed Service for Kubernetes®

How to connect to virtual machines in Nebius AI Cloud

Prerequisites

Set up the VM

Generate a key pair

Configure the user data

Configure the VM

Connect to the VM by using SSH

Shared access to the VM

Example

​Prerequisites

​Set up the VM

​Generate a key pair

​Configure the user data

​Configure the VM

​Connect to the VM by using SSH

​Shared access to the VM

​Example

Prerequisites

Set up the VM

Generate a key pair

Configure the user data

Configure the VM

Connect to the VM by using SSH

Shared access to the VM

Example