Behind The Scenes: GCP IAP + GNU Screen For One-Off Manual Workloads

There are many use cases like diagnosing an intermittent service fault, testing a new service or performing basic analytics like compiling statistics, that require interactive shell access to a VM over a period of hours. We have long made use of VPC Networks and IAP TCP Forwarding to manage SSH logins to those VMs that permit them, but a major challenge of IAP tunneling under GCE is that connections are closed continuously both as a security precaution to require constant reauthentication and due to usage pressure on the IAP gateways. This means that even something as simple as running "gcloud storage ls" to inventory a GGS path to compile a list of failed processing jobs can be interrupted midway through by a dropped connection, making it difficult to run jobs that last more than a few hours. Enter GNU Screen.

For quick manual workloads that only need to run a matter of hours, but need to survive IAP tunnel disconnections, screen is a perfect and simplistic tool that provides a virtual terminal that survives across connections and disconnections.

Installing it is as simple as:

apt-get -y install screen

Using it is as simple as:


This creates a new virtual terminal that replaces the current session. You can then run your commands as normal. If the IAP tunnel disconnects, upon logging back into the VM, you simply type:

screen -r

And you are instantly reconnected to your terminal with the commands you left running continuing to run uninterrupted.

You can even run multiple separate terminals and see them via:

screen -ls

And connect selectively to any of them via the following, where XYZ is the name of a given screen session:

screen -r XYZ

That's all there is to it!