fix: prevent SSH zombie processes with --init flag

Problem: SSH daemon creates zombie (defunct) processes because
container's PID 1 (sleep infinity) doesn't reap child processes.
This prevents SSH connections from being properly handled.

Solution: Add --init flag to docker run command, which:
- Uses Docker's tini init process as PID 1
- Properly reaps zombie processes
- Handles signals correctly
- Allows SSH daemon to fork child processes successfully

Also improved SSH config:
- Removed deprecated UsePrivilegeSeparation option
- Added ClientAliveInterval/CountMax for connection stability
- Ensured UsePAM is enabled for proper authentication
- Added proper ListenAddress configuration

This fixes "Connection closed" errors when connecting to studio via SSH.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: andystime

internal/studio/backend_colima.go

@@ -386,6 +386,10 @@ func (b *ColimaBackend) Create(ctx context.Context, opts *CreateOptions) (*Envir
 	// Build docker run command
 	args := []string{"run", "-d", "--name", containerName}
 
+	// Add --init flag to use tini init process
+	// This prevents zombie processes and allows proper signal handling
+	args = append(args, "--init")
+
 	// Add platform flag if specified
 	if platform != "" {
 		args = append(args, "--platform", platform)

internal/studio/backend_docker.go

@@ -157,6 +157,11 @@ func (b *DockerBackend) Create(ctx context.Context, opts *CreateOptions) (*Envir
 	// Build docker run command
 	args := []string{"run", "-d", "--name", containerName}
 
+	// Add --init flag to use tini init process
+	// This prevents zombie processes and allows proper signal handling
+	// Required for SSH daemon to properly fork child processes
+	args = append(args, "--init")
+
 	// Add security options for SSH to work in containers
 	// SSH's privilege separation requires certain capabilities that Docker's
 	// default seccomp profile blocks, causing "mm_request_receive: bad msg_len" errors

internal/studio/backend_wsl.go

@@ -227,6 +227,10 @@ func (b *WSLBackend) Create(ctx context.Context, opts *CreateOptions) (*Environm
 	// Build docker run command
 	args := []string{"docker", "run", "-d", "--name", containerName}
 
+	// Add --init flag to use tini init process
+	// This prevents zombie processes and allows proper signal handling
+	args = append(args, "--init")
+
 	// Add local GPU passthrough if requested
 	if opts.UseLocalGPU {
 		args = append(args, "--gpus", "all")
@@ -642,21 +646,26 @@ chmod 700 /root/.ssh
 
 cat > /etc/ssh/sshd_config << 'SSHD_EOF'
 Port 22
-Protocol 2
+AddressFamily any
+ListenAddress 0.0.0.0
 HostKey /etc/ssh/ssh_host_rsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
 HostKey /etc/ssh/ssh_host_ed25519_key
 PermitRootLogin yes
 PubkeyAuthentication yes
+AuthorizedKeysFile .ssh/authorized_keys
 PasswordAuthentication yes
 PermitEmptyPasswords no
 ChallengeResponseAuthentication no
-UsePrivilegeSeparation no
 SyslogFacility AUTH
 LogLevel INFO
 X11Forwarding yes
 PrintMotd no
 AcceptEnv LANG LC_*
+TCPKeepAlive yes
+ClientAliveInterval 60
+ClientAliveCountMax 3
+UsePAM yes
 Subsystem sftp /usr/lib/openssh/sftp-server
 SSHD_EOF
 

internal/studio/ssh_setup.go

@@ -61,21 +61,22 @@ chmod 700 /root/.ssh
 cat > /etc/ssh/sshd_config << 'SSHD_EOF'
 # Basic configuration
 Port 22
-Protocol 2
+AddressFamily any
+ListenAddress 0.0.0.0
+
+# Host keys
 HostKey /etc/ssh/ssh_host_rsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
 HostKey /etc/ssh/ssh_host_ed25519_key
 
 # Authentication
 PermitRootLogin yes
 PubkeyAuthentication yes
+AuthorizedKeysFile .ssh/authorized_keys
 PasswordAuthentication yes
 PermitEmptyPasswords no
 ChallengeResponseAuthentication no
 
-# Privilege Separation
-UsePrivilegeSeparation no
-
 # Logging
 SyslogFacility AUTH
 LogLevel INFO
@@ -84,6 +85,10 @@ LogLevel INFO
 X11Forwarding yes
 PrintMotd no
 AcceptEnv LANG LC_*
+TCPKeepAlive yes
+ClientAliveInterval 60
+ClientAliveCountMax 3
+UsePAM yes
 
 # Subsystems
 Subsystem sftp /usr/lib/openssh/sftp-server