Start with command-line verification

Establish a trusted SSH connection first, then open a graphical remote session when needed

This guide organizes node address checks, host fingerprint verification, Xcode graphical workflows, code transfers, network tuning, and secure sign-out into one clear sequence. Use SSH for command-line tasks, and open a remote session only when you need the full macOS graphical interface.

2 primary access methods
6 first-connection checks
1 step-by-step troubleshooting path
Connection routing Session path
Local device SSH verification Physical node
Command-line tasksSSH
Xcode graphical workflowsRemote session
Code and artifactsGit / SFTP
Choose a connection method

Choose the channel for each task instead of putting everything into a graphical session

SSH uses less bandwidth and is ideal for builds, logs, dependencies, and automation. Graphical remote access is for the Xcode interface, simulator monitoring, and settings that must be configured from the desktop.

Preferred channel

SSH command line

Use it for Git operations, dependency installation, script execution, log review, test builds, and CI tasks. First use SSH to verify the node address, credentials, and host status before setting up other access methods.

  • Ideal for long-running builds and automation scripts
  • Disconnecting the graphical interface does not affect background tasks
  • Makes commands easy to copy, logs easy to save, and errors easy to reproduce
Set up when needed

Graphical remote session

Use it to operate the Xcode interface, inspect project settings, monitor the simulator, and work with desktop apps. If the network fluctuates, lower the resolution, frame rate, and color quality first instead of repeatedly creating new sessions.

  • Ideal for tasks requiring a mouse and full desktop
  • Check for an existing session before connecting
  • Explicitly sign out and remove temporary local configuration when finished
First SSH connection

Check the address, username, key permissions, and host fingerprint one by one

Read connection information from the console’s instance details for the relevant order. Do not enter the node address or credentials from chat messages, old screenshots, or forwarded text. When a host fingerprint prompt appears on the first connection, compare it with the fingerprint in the instance details and accept it only when they match exactly.

01

Read connection details

Check the node region, address, SSH port, username, and key type, and confirm that all fields belong to the same order and physical node.

02

Restrict key permissions

The private key should be readable only by the current local user. If the client reports permissions that are too broad, fix the file permissions before reconnecting.

03

Verify the host fingerprint

Compare the algorithm type and fingerprint value character by character. If they differ, stop connecting; do not bypass the warning by deleting the old record.

04

Complete the initial checks

After signing in, confirm the hostname, current user, system version, available disk space, and Xcode path before installing dependencies.

Command execution example

Verify the login first, then run test builds and release workflow checks

The addresses, usernames, paths, and project names below are non-executable placeholders. Replace them with the fields from the console’s instance details and your actual project.

OpsVM connection verification log · Example
SSH → BUILD → RELEASE
$ ssh -i /path/to/private_key -p <port> <user>@<node-address>
The authenticity of host cannot be established.
ED25519 key fingerprint is <fingerprint-to-verify>.
Continue connecting only after verification: yes

<user>@<host> % hostname
<instance-hostname>

<user>@<host> % xcodebuild test \
  -workspace <project-workspace> \
  -scheme <test-scheme> \
  -destination 'platform=macOS'
Test Suite '<test-suite>' passed
Executed <test-count> tests, with 0 failures

<user>@<host> % bundle exec fastlane <workflow-name>
[fastlane] Checking project configuration
[fastlane] Running tests
[fastlane] Exporting artifact
[fastlane] Finished without reported errors
SSH Continue only when the fingerprint matches the instance details.
xcodebuild Start with a narrowly scoped test plan, then expand the workload.
Fastlane Keep sanitized logs in the output so failed stages can be reproduced.
Graphical remote access

Use explicit parameters to create one session and leave headroom for the current network

Field names vary by graphical client, but the connection logic is the same: take the address and port from the instance details, choose resolution and image quality based on the local network, and enable clipboard and file sharing only when necessary.

  1. 01

    Confirm the node and session status first

    Check in the console that the target instance is running normally and that no abandoned graphical session is occupying it. If several team members share the workflow, agree on a session handoff process to avoid disconnecting one another.

  2. 02

    Enter the address, port, and authentication details

    Copy connection parameters from the instance details one by one. Do not store keys, passwords, or recovery information in shared notes, public repositories, ticket screenshots, or unencrypted sync folders.

  3. 03

    Start with moderate resolution and image quality

    For the first connection, use one display, 1920×1080 or lower resolution, and medium color quality. Increase settings gradually after input and video are stable; do not enable high resolution, frame rate, and color depth at the same time.

  4. 04

    Restrict clipboard and directory sharing

    Enable text clipboard sharing only when necessary. Map directories to a dedicated exchange folder; never share the local user directory, key directory, or paths containing signing materials directly.

  5. 05

    Configure lock and sign-out behavior

    Confirm whether client disconnection keeps tasks running, locks the desktop, or ends the session. Use the explicit sign-out flow when finished; do not simply close the client window and assume the session has ended.

File and code transfer

Use version control for code, incremental sync for changed files, and verify archives before extracting them

When choosing a transfer method, consider traceability, incremental updates, file permissions, and the exposure of sensitive information. Do not move private code or build materials through public download links.

Git

Pull traceable code and configuration

Best for repository code, dependency lockfiles, and reviewable configuration. Confirm the remote URL and branch before pulling; configure private credentials through controlled methods and keep them out of the repository.

  • Check the remote and current branch first
  • Pin dependency versions and retain lockfiles
  • Do not commit build artifacts back to the source repository
SFTP

Sync data, logs, and artifacts

Best for incremental resource uploads, sanitized log downloads, and returning build artifacts. Restrict the remote destination directory, then check ownership, permissions, size, and modification time.

  • Use a dedicated exchange directory
  • Verify integrity after transferring large files
  • Delete copies that are no longer needed when the task ends
Archive verification

Compare digests for fixed data packages

Best for one-time delivery of assets, caches, or archives. Generate a digest on the sending side, recalculate it on the node, and compare character by character; extract and process the archive only when the results match.

  • Record the file size and digest before sending
  • Inspect contents in an isolated directory before extraction
  • Reject scripts and binaries from unknown sources
Stability optimization

Reduce graphical load first, then determine whether the issue is the network or client

High resolution, frame rate, and color quality all increase transfer pressure. Change one parameter at a time, preserve before-and-after comparisons, and avoid masking the real cause with multiple simultaneous changes.

Adjust graphical remote session parameters based on network behavior
Symptom First step Second step How to verify
Mouse input latency Lower the resolution Lower the frame rate Move a window and check whether input stays synchronized
Frequent screen redraws Lower color quality Disable dynamic desktop effects Scroll through a code file and observe the redraw area
Intermittent session disconnects Switch to wired or stable Wi-Fi Pause other high-bandwidth tasks Keep an SSH session open to monitor connection continuity
Input works but the screen is stuck Wait for the current render to finish Reconnect to the original session Avoid creating multiple parallel graphical sessions
Priority A Connection medium

Prefer a wired connection; on Wi-Fi, keep the signal stable and avoid sustained high-bandwidth transfers.

Priority B Display settings

Adjust resolution, frame rate, and color quality in that order, changing and recording only one item at a time.

Priority C Task routing

Keep builds, logs, and file operations in SSH; use the graphical session only for tasks that require a graphical interface.

Connection troubleshooting

Troubleshoot in the order of network, identity, session, and display; do not skip prerequisites

Retest after every step and save the complete error text, time of occurrence, node region, and client version. Do not submit only “unable to connect” or a single cropped screenshot.

Connection timed out: what should I check first?

Confirm that the local network works, then verify that the node address and port come from the current instance details. Next check whether the local firewall, corporate network policy, or VPN is blocking the connection. If SSH and the graphical session time out together, prioritize the network path and node status instead of repeatedly reinstalling the graphical client.

Host fingerprint changed: why can’t I simply ignore it?

A changed fingerprint may indicate an incorrect address, a connection to another node, or changed instance information. Stop connecting, recheck the current address and fingerprint in the console, and confirm the order ID and node region. Update the local record only after the new fingerprint’s source has been confirmed.

Authentication failed: how do I distinguish username, key, and permission issues?

First confirm that the username’s capitalization matches the instance details, then verify that the client loaded the intended key rather than an old file with the same name. Check the key file’s permissions, format, and path. If an agent or key-management tool is enabled, verify that it has not replaced the expected authentication material. Do not repeatedly try credentials from unknown sources.

Black graphical session: what should I check, and in what order?

Keep the SSH connection open and confirm that the system still responds. Then check for an existing graphical session, overly high display settings, and client support for the current connection mode. Lower to one display and a lower resolution, then reconnect to the original session. If SSH works but the display remains unavailable, record the client version and session time before submitting a ticket.

Session conflict: how can I prevent multiple connections from interfering?

The team should define the current session owner and handoff time. Check existing sessions before connecting, and use the client’s disconnect or sign-out action when leaving; do not resolve contention by forcibly creating a new session. If background builds must continue, run them in a persistent command-line workflow rather than relying on an open graphical window.

Submit troubleshooting details

At least five types of information belong in a ticket

Include the order ID, node region, incident time, complete reproduction steps, and sanitized logs. For graphical sessions, also provide the client name, version, resolution, and network type.

Sign in to the console to submit a ticket
Secure cleanup

Ending a session is not the same as closing a window—remove connection traces and temporary access points too

After completing the task, sign out of the graphical session, stop listeners you no longer need, check for exposed credentials, and delete temporary exchange files locally and on the node.

Save your work and sign out of the graphical remote session
Confirm whether background builds need to continue
Close unused forwarding ports and tunnels
Delete temporary local connection settings and exchange files
Remove temporary archives and sanitized log copies from the node
Check key-file permissions and storage directories
Rotate related credentials immediately if exposure is suspected
Record recovery steps and environment changes from this session
Credential handling

If you cannot confirm that a credential was not exposed, treat it as exposed

If credentials entered a public repository, shared screenshot, public download directory, or uncontrolled log, stop using them immediately and rotate them. Deleting public copies does not replace rotation because the content may already be cached or copied.

Port handling

Temporary access points should be removed when the task ends

Check SSH tunnels, port forwards, client background processes, and local proxies. Keep an access point only when it still has a clear purpose, and record its owner, purpose, and shutdown condition.

Environment records

Keep reproducible information and remove sensitive material

Retain the system version, Xcode path, dependency lockfiles, build commands, and error summaries; remove private keys, account passwords, recovery codes, temporary exchange archives, and unsanitized logs.

Ready to access a dedicated physical node

Choose a configuration and node to deploy first. If you are still preparing the toolchain, continue with the first-deployment guide or visit the Help Center for help with a specific issue.