Pterodactyl · Pelican · Feather · Wisp · Docker

One egg.
Every shell.
Every direction.

A universal multi-shell egg hosting 0 shell types: SSH with real CA certificates, hardened keys-only, tunnels, interpreter reverse shells, TLS and covert channels, bind shells, browser terminals and debug harnesses. Credentials are the only mandatory setting.

Deploy the egg Read SHELLs.md Documentation

shell types

families

panels + docker

egg json

Set SHELL_TYPE=auto and the console becomes a paginated picker; set it to any id (or a comma list) and everything boots unattended. Multiple shells run side by side on multiple panel ports.

container console

$ SHELL_TYPE=auto bash /entrypoint.sh
</> shell-eggs  Detected panel: Pterodactyl/Pelican
</> shell-eggs  SHELL-TYPE is set to AUTO - opening picker
  +==========================================================+
  |  SHELL-EGGS INTERACTIVE PICKER - choose your shell        |
  +==========================================================+
  How do you want to reach this container?
   1) Server / incoming   - SSH, Dropbear, Telnet, Mosh
   2) Multiplexer         - tmux / screen / zellij
   3) Reverse shell       - container calls back to you
   4) Browse everything   - page through the full catalog
</> shell-eggs  SSH ready on port 2222 (users: alice bob)
</> shell-eggs  Supervisor online. Managed services: ssh

● Server Shells (6)● Multiplexers (3)● Tunnels (6)● Reverse Shells (23)● Secure / Covert (3)● Bind Shells (5)● Web Terminals (4)● Debug Shells (4)

The catalog · 8 families

54 shells. Eight directions. One startup variable.

Pick any combination - a hardened SSH server plus a tmux session, a TLS bind shell plus a Python reverse shell. The first ported shell takes the panel-assigned port; extras get their own. Every family has its own docs page with connection commands.

🖥️

6 shells

Server Shells

SSH (standard, CA-certified, hardened keys-only), Dropbear, Telnet and Mosh listeners for managing the container.

🔁

3 shells

Multiplexers

tmux, GNU Screen and Zellij persistent sessions that survive disconnects - attach from any login shell.

🕳️

6 shells

Tunnels

SSH -L / -R / -D forwarding, X11, rsync-over-ssh and sshfs mounts through an encrypted channel.

🎣

23 shells

Reverse Shells

Interpreter and netcat-family callbacks: bash, python, PHP, perl, ruby, lua, node, powershell, go, java, groovy, awk, nc/socat and TLS flavors. Every payload reconnects forever.

🛡️

3 shells

Secure / Covert

TLS-wrapped shells plus websocket, DNS and ICMP channels for egress-restricted networks. TLS stops payload inspection - pin certs.

📡

5 shells

Bind Shells

Listeners inside the container - plain nc, full-PTY socat, TLS binds and interpreter binds. You connect in.

🌐

4 shells

Web Terminals

Browser xterm.js terminals (ttyd, gotty) and token-authed HTTP exec shells (php/node) - a shell in a browser tab.

🔬

4 shells

Debug Shells

sshd -ddd auth debugging, strace-everything login shells, tcpdump capture sessions and a hex-dump socat probe relay.

Full connection guides for every entry: SHELLs.md · also printed to your server console at boot.

Port policy

Ports that actually work on panels

Pterodactyl / Pelican / Feather / Wisp

primary shell binds the panel-allocated SERVER_PORT automatically

Docker / standalone

binds SERVER_PORT (you choose it, default 8888) - no panel required

Extra shells

SHELL_EXTRA_PORTS positionally, so 3 shells = 3 allocated panel ports

Reverse + multiplexers

no inbound port at all - they call out or live in-session

Configuration

Credentials mandatory. Everything else optional.

Every egg variable has a working default. Give it users and passwords (or let it generate crypto-random secrets) and the egg is fully operational.

SHELL_TYPE

Which shell(s) to run.

SHELL_PASSWORDS

Positionally matched to Shell Usernames ('S3cretA,S3cretB').

SHELL_EXTRA_PORTS

OPTIONAL: comma-separated extra panel ports for additional PORTED shells (the primary shell always binds this server's default port).

All 24 variablesrequiredSHELL_USERS - Shell Usernames

Tested, not claimed

Verified in real container boots

SSH password + SFTP + generated credentials	[OK] real sshpass login in CI
SSH CA certificates	[OK] signed cert login; wrong principal rejected
Hardened keys-only	[OK] password refused, pubkey accepted
Telnet + shadow auth	[OK] login OK; bad password rejected
Reverse shells (python/nc/bash)	[OK] reached external listener, command round-trip
TLS bind shell	[OK] socat OPENSSL round-trip in container