# Open a shell in a service

The **Console** tab opens an interactive shell inside a running replica of a service, straight from your browser. Use it to inspect a live container, run one-off commands, or debug in place.

## Connect

1. 
2. 
3.

The shell runs inside the live container, with the same filesystem, variables, and network access as your app. When the session ends, the transcript stays on screen and a **Reconnect** action starts a fresh session.

> **Warning:**
>
> Anything you run takes effect in the live replica immediately. Changes to the container's filesystem are temporary — replicas are recreated from the image on every restart and deploy; only files under an attached [volume's](/docs/services/volumes) mount path persist.

## Databases

Databases have a Console tab too — a database is never internet-reachable, so this is how you reach one interactively. **Connect** opens a shell inside the database container; at the prompt, run `psql` on [Postgres](/docs/databases/postgres) or `redis-cli` on [Redis](/docs/databases/redis) for an interactive database session.

## Detach into its own window

During a live session, the **Detach** button opens the terminal in its own window with your current replica, container, and shell selection. It is a new, independent session — the drawer's shell keeps running, and you can detach as many windows as you like.

The window's URL carries only the route and your selection, never a credential. Reloading the window reconnects automatically.

## Access and auditing

Opening a shell requires the editor role or higher — see [teams and roles](/docs/collaboration/teams-and-roles). Every console session is recorded in the [audit log](/docs/collaboration/audit-log).

The connection goes directly from your browser to the running replica over an encrypted channel. It authenticates with a connect-only credential scoped to the environment, minted on first use and rotated whenever a member loses access.