DOCKER

Containers

Kiri runs containers through the Docker Engine API, so you use the ordinary docker CLI against the kiri context. This page lists what that covers today: the commands, the flags on docker run, resource limits, security flags and restart policies.

If you’d rather not switch contexts, every Docker command also works as a kiri command, which always talks to Kiri: kiri run, kiri ps, kiri exec, kiri logs and the rest.

Supported commands

Command Notes
docker run, create, start The flags in the next section.
docker ps -a, and --filter on id, name, label, status, ancestor, network, exited and volume. A status or exited filter lists stopped containers without -a, as Docker does.
docker exec With -it for a shell.
docker logs, attach
docker stop, restart -t sets the wait before SIGKILL (10 s by default).
docker kill -s picks the signal; SIGKILL by default.
docker pause, unpause The container’s processes are frozen, not stopped.
docker rm -f for a running container, -v to remove its anonymous volumes too.
docker wait, rename
docker update Memory, CPU and PID limits, and the restart policy. New limits apply now and at every later start.
docker stats, top stats streams a sample a second, or one with --no-stream.
docker diff, export, commit commit takes --change lines.
docker cp Both ways, whether the container is running or not.
docker inspect, port
docker container prune --filter on until and label.

A command outside this list gets an error that says Kiri doesn’t support it, rather than doing something half right.

Flags on docker run

The everyday ones: --rm, -d, -it, -e, -u, -w, --name, --entrypoint, --hostname, --label, --expose, --stop-signal and --stop-timeout. An image’s own STOPSIGNAL is used when you don’t give one.

Networking, ports and mounts have their own pages: Networks and ports and Volumes and mounts. --platform is on Images and Rosetta.

Limits

Flag What it sets
--memory The container’s memory ceiling.
--cpus CPU time: --cpus 1.5 is 150 ms of CPU every 100 ms. --cpu-quota and --cpu-period set the same thing directly.
--cpu-shares The container’s weight against others when CPUs are busy.
--pids-limit The most processes the container may have.
--shm-size The size of /dev/shm.

Limits are cgroup limits inside Kiri’s VM. The VM’s own CPUs and memory are set in Settings.

Security

Each container gets Docker’s default set of 14 capabilities and a default seccomp filter. Syscalls that reach outside the container (kernel modules, keyrings, the clock, swap, new mount and user namespaces, io_uring, bpf) fail unless the container holds the capability that makes them legitimate.

Flag Effect
--cap-add, --cap-drop Add or drop capabilities by name (NET_ADMIN or CAP_NET_ADMIN), or ALL.
--privileged Every capability, and no default seccomp filter.
--read-only The container’s root filesystem is mounted read-only.
--security-opt seccomp=unconfined No default seccomp filter.
--security-opt no-new-privileges Processes can’t gain privileges, for example through setuid binaries.

States and exit codes

A container is created, running, paused or exited, as in Docker. docker stop sends the stop signal (SIGTERM unless the image or --stop-signal says otherwise), waits up to 10 s, then sends SIGKILL. A process ended by a signal exits with 128 plus the signal number.

docker create / runcreatedstartrunningpauseunpausepausedstop · killor the process endsstartor restart policyexitedwith an exit codedocker rmremovedExit codes0exited cleanly137SIGKILL (128 + 9)143SIGTERM (128 + 15)139crashed, SIGSEGV255running when thedaemon stopped
A container's states. Restart policies take an exited container back to running on their own; docker rm ends it. The exit code tells you how it stopped.

Kiri’s window puts the same states into words: a running container shows how long it has been up, and a stopped one shows Stopped for code 0, Killed (137), Crashed (139) or Failed with its code. Hover over the state to see when it stopped.

Kiri
ContainersImagesVolumesNetworksSettings

Containers

webnginxUp 12 minStop⋯
workerpython:3.13Up 4 min (Paused)Stop⋯
migratemyappStoppedStart⋯
cronalpineKilled (137)Start⋯
The Containers list in Kiri's window. Stop and Start are on each row; Pause, Resume, Restart and Remove are in the ⋯ menu.

Restart policies

--restart takes Docker’s four policies:

Policy Starts the container again when
no Never. The default.
on-failure[:N] It exits with a code other than 0, up to N times if you give N.
always It exits, whatever the code, and when the daemon starts.
unless-stopped As always, except after you stopped it yourself.

Restarts back off as Docker’s do: 100 ms, doubling each time, up to a minute. docker stop or docker kill stops restarts until you start the container again. --restart can’t be combined with --rm. To change the policy of an existing container, use docker update --restart.

Records survive a daemon restart

Kiri saves every container’s record to containers.json in its data folder (~/Library/Application Support/Kiri) on each change. When the daemon starts again, docker ps -a still lists your containers, and each keeps its writable layer.

Containers that were running when the daemon stopped come back as exited with code 255. Those with always, or unless-stopped that you didn’t stop, are started again straight away. --rm containers aren’t saved: they’re gone by the time anyone could ask for them.

Not supported

  • --network container:<name>, sharing another container’s network.
  • Mount types other than bind, volume and tmpfs.
Networks and portsBridges, DNS by name, and publishing ports to the Mac.Volumes and mountsNamed volumes, bind mounts of Mac folders, tmpfs.The windowEach container’s page: details, logs, a command line and its files.

© 2026 Kiri · runkiri.com