FEATURES

Container files in Finder

The files of every running container are in Finder at ~/Kiri. Open a config file in your editor, check what a build put in /app, or drag a log file into an email, without docker cp or docker exec. What you see is the container’s filesystem as it is right now.

The ~/Kiri folder

Kiri mounts ~/Kiri when the daemon starts. It holds one folder per running container, named after the container, and each folder is that container’s whole filesystem from /.

web

RecentsApplicationsDownloadsKiri

~/Kiri/web

binFolder

etcFolder

usrFolder

varFolder

~/Kiri in Finder: one folder per running container. Inside each is the container's root filesystem.

Path	What
`~/Kiri/`	One folder per running container.
`~/Kiri/<name>/`	The container’s `/`.
`~/Kiri/<name>/etc/nginx/nginx.conf`	`/etc/nginx/nginx.conf` inside the container `<name>`.

Compose containers appear under their container names, such as ~/Kiri/shop-api-1. A container that stops leaves the folder; when it starts again, its folder comes back.

With one container, web from the nginx image, running:

zsh

$ ls ~/Kiri
web
$ ls ~/Kiri/web/etc/nginx/conf.d
default.conf

Read-only, and always current

The files are read-only from the Mac: Finder shows the lock, and your editor opens them for reading. To change a file in a container, change it inside (docker exec, docker cp), or use a bind mount of a Mac folder for files you want to edit.

They are also never stale. Every time a file is opened, the Mac asks Kiri for its current attributes, so a file rewritten inside the container a moment ago shows its new contents. Nothing is copied up front: Kiri reads a file from the VM only when something on the Mac reads it.

Files show as owned by you, so Finder opens them without asking for a password.

How it works

~/Kiri is an NFS mount. Kiri’s daemon serves a small read-only NFS server, and macOS’s own NFS client mounts it. There is no kernel extension and no admin password.

Finder reads a file at ~/Kiri: macOS's NFS client asks Kiri's daemon over a Unix socket, and the daemon reads the file from the running container's filesystem in the VM over vsock.

The server listens on a Unix socket, ~/.kiri/files/nfs.sock, in a folder only you can open, rather than on a network port. The kernel tells Kiri who connected, and only the Mac’s NFS client and your own user get in, so other accounts on the Mac can’t read your containers’ files. The mount is soft: if the daemon goes away, Finder gets an error instead of hanging.

When the daemon stops, it unmounts ~/Kiri.

The Files tab

Each container’s page in Kiri’s window has a Files tab, next to Overview, Logs and Terminal. It browses the same files as ~/Kiri, starting at the container’s /.

Kiri

ContainersImagesVolumesNetworksSettings

web Up 3 minutes

web / etc / nginxShow in Finder

conf.d—

mime.types

nginx.conf

/etc/nginx/nginx.confSave to Downloads

user nginx; worker_processes auto; …

The Files tab: click folders to go in, the path at the top to go back up, and a file to preview it.

Action	What it does
Click a folder	Opens it. The path at the top takes you back up.
Click a file	Shows a text preview. Binary files and files over 256 KB aren’t previewed.
Save to Downloads	Copies the selected file to `~/Downloads` and shows it there. If a file of that name exists, the copy is named `name 2.ext`.
Show in Finder	Opens the selected file, or the folder you’re in, in Finder under `~/Kiri`.

Volumes and mountsBind mounts for files you want to edit from the Mac.The windowEach container’s page: details, logs, a command line and files.