Troubleshooting¶

Fixes for the problems you are most likely to hit with Sushi OpenShell.

The instance type is not offered, or the launch fails¶

The image is ARM64. Choose a Graviton instance type, such as the recommended t4g.medium, with at least 4 GiB of memory and a root volume of at least 32 GiB.

Session Manager cannot connect¶

The instance needs an IAM instance profile that allows Systems Manager, for example with the AWS managed policy AmazonSSMManagedInstanceCore.
The instance needs outbound HTTPS to reach Systems Manager.
Give it a few minutes after launch to register.

SSH times out¶

The recommended security group allows SSH only from private 10.x.x.x ranges. Edit the rule so its source is your own address, or use Session Manager.

`openshell status` does not say "Connected"¶

First boot may still be running. Wait for it, then check the first-boot service:

sudo cloud-init status --wait
sudo systemctl status sushi-openshell --no-pager

If it failed, retry it:

sudo systemctl restart sushi-openshell

Then check the gateway's own service, as ubuntu:

export XDG_RUNTIME_DIR=/run/user/$(id -u)
systemctl --user status openshell-gateway

`openshell` commands fail with a permission or certificate error¶

Run them as ubuntu, not as root or ssm-user. From Session Manager, switch with sudo -iu ubuntu. The gateway certificates belong to ubuntu.

A sandbox cannot reach the internet¶

That is the default policy working. Create the sandbox with a policy that allows the exact endpoints it needs. See Sandboxes and policies.

The demo script says "Run this demo as ubuntu"¶

Switch user and run it again:

sudo -iu ubuntu
bash /opt/sushi/docs/demo.sh

Still stuck?¶

Email info@softwaresushi.com with the image version and a redacted error. Do not include keys or certificates.