refactor some of the container terminal SSH logic; ensure the local private key has limited permissions