Headless environments (especially containers) should support sf org login web

[mhemani-reach]

Currently, the Salesforce CLI does not support headless authentication when using sf org login web. This limitation makes it difficult to authenticate Salesforce orgs in environments without a browser, such as Docker containers. I would expect that the CLI will output a one-time URL to the console, that will direct the user to complete authentication in their preferred web browser; when the ENV variable SF_CONTAINER_MODE=true

This will allow developers to fully run the Salesforce CLI Docker image, which will help streamline developer workflows

This is a followup from #3415

[wrt83]

I'm also curious how Salesforce makes this work on their code-server deployment (Agentforce Vibes). This is clearly running each dev env on a container, but sf org login web functions as expected. I'm almost wondering if supporting this for vs code devcontainers is a simple config change we aren't aware of.

[cristiand391]

for headless authentication we recommend to use jwt auth:
https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_jwt_flow.htm

I would expect that the CLI will output a one-time URL to the console, that will direct the user to complete authentication in their preferred web browser; when the ENV variable SF_CONTAINER_MODE=true

sf org login web blocks headless auth on purpose when SF_CONTAINER_MODE=true

[branderson-js]

@cristiand391 I am trying to find a solution to something similar. The issue now is when you refresh a sandbox, ECAs do not propagate over. How would I go about deploying my metadata from Version Control if I use JWT to authenticate my sf-cli