Later
Inside Stormglass
Stormglass is a desktop client for Kubernetes. The plan is to ship Kiri inside it as the built-in Docker runtime, so its users get containers without installing anything else.
In the lab Mac · Windows · Linux · written in Rust
The container runtime
that does less.
Kiri runs Docker containers with one Rust daemon: in one small VM on a Mac, inside WSL2 on Windows, straight on the kernel on Linux. No dockerd, no containerd, no shims, no runc. The docker CLI, Compose and the Docker API work as they do today.
14.2 ms
Measured
for docker run --rm alpine true, start to finish, through the same docker CLI.
Docker Desktop takes 243.3 ms, OrbStack 442.2 ms. p50 of 30 runs on one Mac. On Windows: 78 ms against 491 ms.
Kiri is still in the lab. The numbers are real; the downloads aren't out yet.
$ kiri run --rm alpine echo "kiri" prints kiri. $ kiri run -d --name web nginx prints a container ID. $ kiri ps lists the running web container. $ curl http://web.kiri.localhost reaches it by name, with no port to remember. $ docker ps shows the same container, because Kiri answers the Docker API.
docker command runs on Kiri.Works with what
you already use
dockerdocker composedocker buildx- Docker Engine API
- Docker Hub
- OCI images
ghcr.io- Dockerfiles
Compare
Same command, three routes.
Docker Desktop and OrbStack pass every container start through five programs, each with its own socket. Kiri passes it through one daemon that calls the kernel itself. Same docker command on all three.
OrbStackMeasured0 ms
Five hops. One shim process stays resident for every running container.
Docker DesktopMeasured0 ms
The same five hops, and a shim per running container.
KiriMeasured0 ms
One daemon creates namespaces, cgroups and mounts itself. Nothing per container is left running. Most of this time is the docker CLI starting up; Kiri's own part is about 2.5 ms.
p50 of 30 runs on one Apple Silicon Mac, all three through the same docker CLI with Docker's default bridge networking. Stops are drawn evenly; only the totals are figures. Windows has its own race.
Full benchmarks: p99s, the Docker API path and every raw figure
How it works
One small VM. One daemon. A socket between them.
On macOS, Kiri boots a single Linux VM through Apple's Virtualization.framework, with a custom kernel and a small Rust init as PID 1. The host and guest talk over vsock. Inside, the Kiri daemon creates each container with clone3. On Linux the same daemon runs on your own kernel with no VM at all, and on Windows it runs inside WSL2.
One VM, one daemonSee the numbers
Boot once
One VM serves every container. Cold boot to ready takes 112 ms, down from 810 ms on a stock kernel.
Talk directly
Requests cross one vsock channel into the VM, not a chain of Unix sockets. A round trip takes 31 µs.
Leave nothing behind
No process stays per container. OrbStack keeps a shim for each one: 143 running containers held 1.13 GB in shims on our test Mac.
Measured on one Apple Silicon Mac. Method and raw numbers are on the benchmarks page.
The app
A native app, not a web wrapper.
AppKit and the system WebKit on the Mac, Win32 and WebView2 on Windows, so no Electron and no bundled browser. Manage containers, images, volumes, networks and Compose projects, with live stats, logs, a terminal and files for each container. Running apps open by name at myapp.kiri.local. On the Mac it brings your images and volumes over from OrbStack or Docker Desktop, and lives in the menu bar.
The name
Kiri means "a little"
It comes from the Igbo word ntakịrị, "small" or "a little". That is the whole idea: a little code, a little memory, a little time.
Coming soon
Still in the lab.
Kiri runs, and every number on this page was measured on it. It isn't out yet: we're finishing the first public release for Mac, Windows and Linux. On every platform Kiri sets up a kiri docker context and brings its own docker, Compose and buildx, so nothing else needs installing.
On launch day, in a new terminal:
$ docker run --rm hello-worldSame docker and docker compose you use today.