SSH ProxyJump at Scale: Where It Breaks Down and What to Do Instead
Most engineers meet SSH ProxyJump the same way: a single bastion host stands between the public internet and a private network, and one clean -J flag replaces a clunky chain of manual hops. For small teams managing a handful of servers, it feels like a solved problem. But infrastructure grows, teams grow, and the assumptions that made ProxyJump elegant at ten servers start to strain at ten thousand. What works cleanly in a small environment often becomes a liability in a large one, and understanding why is the first step toward finding a better approach.