Skip to content

SSH Connection to Odoo Container Instance

This guide explains how to connect to the Odoo ECS container instance via SSH to verify the filestore volume mount and perform system maintenance.

When to Use SSH Access

You may need SSH access to the container instance in the following situations: - Verifying filestore volume is properly mounted - Checking disk space and storage utilization - Troubleshooting file permission issues - Investigating container runtime problems - Performing manual maintenance tasks - Accessing logs directly on the host system

Prerequisites

  • SSH client installed (Terminal on macOS/Linux, PuTTY on Windows)
  • Access to 1Password with CNF credentials
  • Network connectivity to AWS infrastructure
  • Basic knowledge of Linux command line

SSH Key Setup

1. Retrieve SSH Keys from 1Password

  1. Bastion Host Key: Locate the key named cnf_odoo_bastion in 1Password
  2. Container Instance Key: Locate the key named SSH key for odoo ecs container instance in 1Password
  3. Save Keys: Download both private keys to your local machine (typically in ~/.ssh/)

2. Set Proper Permissions

# Set correct permissions for SSH keys
chmod 600 ~/.ssh/cnf_odoo_bastion
chmod 600 ~/.ssh/odoo_ecs_instance_key

Connection Process

1. Direct Connection Using Jump Host (-J option)

The most efficient method is to use SSH's built-in jump host capability:

# Connect directly to container instance through bastion using -J option
ssh -i ~/.ssh/odoo_ecs_instance_key -J ec2-user@ec2-3-97-127-122.ca-central-1.compute.amazonaws.com ec2-user@ec2-52-60-76-88.ca-central-1.compute.amazonaws.com

# If using different keys for bastion and container instance
ssh -i ~/.ssh/odoo_ecs_instance_key -o "ProxyCommand ssh -i ~/.ssh/cnf_odoo_bastion -W %h:%p ec2-user@ec2-3-97-127-122.ca-central-1.compute.amazonaws.com" ec2-user@ec2-52-60-76-88.ca-central-1.compute.amazonaws.com

4. Alternative: SSH Tunnel Connection

You can also create an SSH tunnel for direct access:

# Create SSH tunnel through bastion
ssh -i ~/.ssh/cnf_odoo_bastion -L 2222:ec2-52-60-76-88.ca-central-1.compute.amazonaws.com:22 ec2-user@ec2-3-97-127-122.ca-central-1.compute.amazonaws.com

# In another terminal, connect directly through tunnel
ssh -i ~/.ssh/odoo_ecs_instance_key -p 2222 ec2-user@localhost

Verifying Filestore Volume Mount

1. Check Mount Points

Once connected to the container instance, verify the filestore volume is properly mounted:

# List all mounted filesystems
df -h

# Check specific mount points
mount | grep filestore

# Verify EFS/EBS volume mounts
findmnt -t nfs4,ext4

2. Verify Odoo Filestore Directory

# Check if Odoo filestore directory exists and is accessible
ls -la /opt/odoo/
ls -la /opt/odoo/filestore/

# Check ownership and permissions
ls -la /opt/odoo/filestore/

3. Check Docker Volume Mounts

# List running containers
docker ps

# Inspect container volume mounts
docker inspect <container_id> | grep -A 10 -B 5 "Mounts"

# Check container's view of mounted volumes
docker exec <container_id> df -h
docker exec <container_id> ls -la /var/lib/odoo/filestore/

4. Verify Storage Health

# Check disk usage
du -sh /opt/odoo/filestore/*

# Check inode usage
df -i

# Verify file permissions
find /opt/odoo/filestore -type d -exec ls -ld {} \;

Common Issues and Troubleshooting

Mount Point Not Found

  • Verify EFS/EBS volume is attached to the instance
  • Check /etc/fstab for mount configuration
  • Review CloudWatch logs for mount errors

Permission Denied

  • Verify file ownership: chown -R odoo:odoo /opt/odoo/filestore
  • Check SELinux context if applicable
  • Ensure proper security group configuration

Connection Refused

  • Verify SSH keys are correct and have proper permissions
  • Check security group allows SSH (port 22) from bastion
  • Confirm instance is running and accessible

Security Notes

  • Key Management: Store SSH keys securely in 1Password
  • Session Timeout: SSH sessions will timeout after inactivity
  • Audit Trail: SSH connections are logged for security auditing
  • Principle of Least Privilege: Only use SSH access when necessary
  • Key Rotation: Regularly rotate SSH keys as per security policy

Next Steps

After verifying the filestore mount: - Document any findings in the appropriate project tracking system - Report issues to the development team if mount problems are discovered - Update monitoring alerts if storage thresholds need adjustment