Releases

Fixed

• Turning off automatic updates now sticks. On Mac, Windows and Linux, Settings showed Off, but the choice wasn't saved, so Kiri checked for updates again at the next launch. It's saved now.
• Turning on crash reports sends only new crashes. Switching them on used to send every crash still waiting, including ones you'd answered Not now to. Kiri now sends only crashes from after you turned reports on. You can still send an older one yourself from its card.
• Logs and reports take out more secrets. Passwords in URLs, Authorization values of any kind, PEM private keys, values after flags such as --password, GitHub, GitLab, Docker Hub and AWS access key tokens, and keys such as PGPASS, API-KEY and *_PRIVATE_KEY are now replaced with [redacted] before anything leaves your computer. It errs towards taking out too much: the whole user part of a URL goes, not only its password.
• Windows: updates stay on HTTPS. Kiri no longer follows a redirect from the update feed down to plain HTTP, and release builds no longer accept a feed from a local file.
• Crash reports never carry your Kiri Cloud account. A crash sent while you were signed in to Kiri Cloud went with your sign-in, so it named your GitHub account. Crashes now always go without it. A diagnostics report you send yourself still says it's from you, so we can reply, and the Send dialog says so.
• Crash reports leave out your image and container names. The log lines a crash report carries named the images you pulled and the containers that stopped, including private registries. Those names are now taken out wherever they appear in the report.
• Windows: reports take out your user name in every form. Your home folder was only blanked when written exactly as C:\Users\you. Now it also goes in lower case, with forward slashes, doubled inside JSON, as WSL's /mnt/c/Users/you, and as /home/you in the engine's log.
• Still more secrets are redacted. password: … and key = … with spaces, Cookie and Set-Cookie headers, X-Api-Key, JWTs, Stripe, Slack, Anthropic, OpenAI, Google, npm and PyPI tokens, and email addresses. A secret written inside another value, such as env=[DB_PASSWORD=…, is no longer missed.
• Settings says exactly what a crash report sends: the stack trace, the last 200 log lines, versions, the computer's model and a random ID for this install.

0.1.16 was tagged but never released; its fixes are in this release.

Thanks to [@9trocode](https://github.com/9trocode) for the first four fixes, Kiri's first outside contribution.

New

• Linux: signed packages and repositories. Every .rpm and the Linux checksums are signed with the Kiri Releases key, and download.runkiri.com now serves signed apt and dnf repositories, so apt upgrade and dnf upgrade can keep Kiri current. The key is kiri-archive-key.asc on the download site.

Fixed

• Mac: image files no longer come back empty. When the engine went to sleep or stopped right after a pull, the VM could stop before its disk had caught up, and a newly unpacked image could keep its file names but lose their contents. Builds then failed in RUN steps and some programs (iperf3, for one) wouldn't start. Kiri now waits for the engine's VM to power off, writes each layer out in full before using it, and unpacks again any layer that was cut short.
• kiri share no longer crashes when its output goes away. Piping it into a command that exits, or closing the terminal it printed to, made it panic and leave a crash report. Kiri commands now end quietly when their output is closed.

New

• A fresh Kiri is quiet. Nothing downloads and nothing new appears until you use it: the build engine (BuildKit) is fetched the first time you build, not at setup, and an empty Images list no longer offers a download.
• The Engine card is your switch. A fresh Kiri reads Off with Start, even while it sets itself up inside. Press Start and it reads Running, and stays Running while the engine rests between uses. Press Stop and it reads Off. A container you start yourself, for example with docker run in a terminal, also turns it to Running. The button is always there, and Settings › Resources has the same switch.
• Linux: Kiri shows in software centers. After installing the .deb or .rpm, Ubuntu's App Center, GNOME Software and KDE Discover list Kiri with its name, description and icon.

Changed

• Linux: installing doesn't start anything. The engine starts when you set Kiri up (open Kiri, or sudo kiri host-access $USER), and then it waits asleep until you use it.
• The engine starts asleep. After setup, a restart or a login it doesn't run a VM nobody asked for; the first docker command, pull or Run wakes it in about a tenth of a second. Containers with a restart policy still come back at once. An upgrade leaves a running engine alone and says how to restart it on the new version.
• Kiri's own builder stays out of your lists. It's hidden from Images and Volumes as it already was from Containers; Settings › Builds shows it and can clear the build cache.

Fixed

• Upgrades never leave an old Kiri running. On Windows each engine start brings in this version's engine, so declining Restart engine no longer keeps the old one coming back at every login. On Mac and Linux the window warns when an older kiri comes first on your PATH and says how to remove it, and docker warns when the engine runs another version.
• Uninstalling stops everything. kiri setup --uninstall, removing the Linux package, and the Windows uninstaller now stop every Kiri window and command still open.
• Shares no longer stall on a single connection. A share that used one connection stopped after about 256 KB on some Kiri Cloud edges and waited there. Kiri now uses the window the edge offers, so one-connection shares run at full speed.
• Linux: Builds set up on Ubuntu. The optional Builds step could fail with "docker buildx create failed" when docker already talked to Kiri without a kiri context. Kiri now makes the context when it's missing (without changing which engine plain docker uses), and when a step fails the window says why.
• Linux: setup finishes before Open Kiri. Open Kiri waits until docker and builds are set up or skipped, and Kiri no longer says docker still uses Docker's engine when it already reaches Kiri.
• Linux: the Kiri icon shows right after installing. GNOME showed an empty tile in search until you logged out and back in.

New

• Check for updates from Settings → About. The version line says what Kiri last found ("up to date, checked 3 min ago") and has Check now. When there's a newer version it shows Download, What's new and the notes, then a progress bar, then Restart to update. Until now Kiri only looked when it opened, and checking by hand was hidden in the Mac menu bar or the Windows tray icon.
• Check for updates automatically, a switch next to it, on by default. Turned off, Kiri only looks when you press Check now.

Fixed

• Windows: What's new shows the release notes. The update card on Windows never had What's new, because the Windows update feed carried no notes. Every release now ships its notes on Mac and Windows alike.
• Linux: the window no longer offers the Mac app as an update. It read the Mac's update feed. It now tells you when a newer version is out and links to the releases page for the new .deb or .rpm; kiri update on Linux does the same.

New

• Linux: Kiri sets itself up when it opens. Before the main window, Kiri checks that its engine is installed and running, that your account can use it, that docker talks to Kiri and that builds work, with a button to fix each. Your password is asked once, by the system's own prompt, and your account can use Kiri straight away: no logging out and back in. Kiri only asks you to log out on a system that can't apply the access right away, and then gives you Log out and Restart buttons. From a terminal, sudo kiri host-access $USER does the same.

Fixed

• Stop stays stopped. Stop used to put Kiri to sleep, and the next build, docker command or share woke it again within seconds. Now Stop stops every container, closes your shares and keeps Kiri off until you press Start, even across restarts of your computer; a docker command in the meantime says Kiri is stopped. Kiri still sleeps by itself when it's idle and wakes when you need it, as before.
• Linux: stopping, restarting or removing Kiri leaves nothing running. Until now systemd's stop ended Kiri's engine at once, without its shutdown, so containers were left running after systemctl stop kiri or uninstalling the package, and systemctl restart kiri could report a failure. The engine now stops its containers and cleans up first.
• Linux under WSL: containers reach the internet every time. Containers asked WSL's DNS forwarder directly, and about a third of their lookups went unanswered ("bad address", timeouts). They now resolve through Kiri, which asks it from the host's side.
• Long image tags no longer get cut off in the Images list: a tag that is a commit hash shows its first 12 characters, other long tags end in "…", and the whole tag is on hover.

Better

• Click a tag to copy it, the whole tag, without opening the image.
• The Containers list leaves out docker build's BuildKit workers (buildx_buildkit_…): they're the build machinery, not containers you ran. Your builds are still under Builds.

Known issue

• --add-host name:host-gateway with BuildKit still fails, with buildx's own error, because buildx only allows it for Docker's built-in builder. Use the gateway address itself, or DOCKER_BUILDKIT=0. Kiri's own built-in builder will fix it in a later release.

New

• IPv6 networks: docker network create --ipv6 (and --ip6, Compose enable_ipv6) works, including IPv6-only networks (--ipv6 --ipv4=false), NAT66 to the internet and ports on [::1]. Kiri now passes the same IPv6 checks as Docker on Mac, Windows and Linux.
• Docker's DNS at 127.0.0.11: containers on your own networks find each other by name the way they do under Docker, and one slow --dns server no longer holds up every other lookup.
• Share names are checked before they're yours: kiri share reserve NAME asks for the name, and kiri share names shows the ones waiting and any that weren't approved, with the reason.

Fixed

• kind and kiri k8s reach your computer: host.docker.internal, host.kiri.internal and gateway.docker.internal resolve inside kind nodes, their pods and kiri k8s pods.
• A volume over an image folder keeps its owner: it used to come up owned by root with no permissions, so redis couldn't save.
• Networks that should be cut off are: IPv4-only networks no longer hand out IPv6, --internal networks fail straight away instead of hanging, and the disable_ipv6 sysctl is honoured.
• docker ps --filter name=^web$ matches exactly, as Docker does.
• Builds no longer stall on the image mirror on Windows and Linux, including after upgrading and when the network moves, and FROM an image that exists only in Kiri works there.
• --add-host name:host-gateway in a classic build (DOCKER_BUILDKIT=0) on Windows and Linux points at your computer (the bridge gateway), as docker run does, instead of an address that only exists on a Mac.
• docker inspect of a container sharing another's network (--network container:…) shows no networks of its own, as Docker does, instead of a made-up one.
• Windows: networks work on WSL2's own kernel, which lacks a firewall module Kiri used for IPv6.

Better

• Builds start faster after a pause: an idle build worker is paused instead of stopped, so the next build starts in about a second with its cache warm. It still stops before the engine sleeps, so an idle Kiri uses no more memory than before.
• Containers list: every column sorts and resizes, as in Images.

Known issue

• --add-host name:host-gateway with BuildKit still fails, with buildx's own error, because buildx only allows it for Docker's built-in builder. Use the gateway address itself, or DOCKER_BUILDKIT=0. Kiri's own built-in builder is planned for 0.1.12.

New

• Kiri for Intel Macs: a disk image built for Intel, signed and notarized like the Apple silicon one, with its own update feed. The download page offers it to Intel Macs.

New

• Kiri for Windows: an installer for x64 PCs and one for ARM PCs (Surface, Snapdragon laptops). The download page picks the right one, or you can choose. The installers aren't signed yet, so Windows asks you to confirm before it runs.
• Every download names its chip: Mac, Windows and Linux files say arm64 or x86_64, and each copy of Kiri updates from its own feed.

Better

• Linux packages are tested on Ubuntu and Fedora before each release: install, service, a container with internet, a published port, then a clean uninstall.
• The .rpm packages are about a quarter smaller.
• The download page shows only what's actually available, so every link works.

New

• kiri in every terminal: zsh and bash, in Terminal, iTerm, VS Code, tmux and IDE terminals, not only new Terminal windows.
• Share traffic: a share shows its traffic and how long it has been up. Another computer's share can be stopped from here too.

Better

• Containers look the same on every row: the address or image on a second line, columns as wide as their values, and a Compose project's containers grouped under it.
• Container details start with the name and state, then the image, a short ID you can copy, and the Compose project.
• Shares are faster over long distances, using several connections at once.

Fixed

• With saved column widths, a row's last button no longer runs past the Actions column.

New

• Kiri Share: press Share on a container and it answers at a public HTTPS address on runkiri.cloud. Shares from all your computers show in one list.
• Kubernetes in the window: Pods, Services and Settings → Kubernetes. kind runs on Kiri too.
• Builds: a Builds view, a page for each image with its layers, and a vulnerability scan.
• Images: search Docker Hub, watch each layer pull, and cancel a pull. Sign in to private registries.
• Restart is the first button on a running container.
• Updates in the window: they download in the background, install on restart, and open this page.
• A theme button beside the name, a text size in the View menu, and sortable, resizable columns.

Better

• Pulls don't hang: a dead registry address is skipped, a stalled download picks up where it stopped.
• More of the Docker API: networks, --network container:, health checks, sysctls, log files and volumes.
• Containers aren't reachable from your network unless you publish a port.
• Container status counts as it goes, says Stopped for a clean stop, and shows failures in red.
• The VM sleeps when idle, even with the window open, and gives memory back.
• Settings opens straight away, and the window stays responsive while you drag and resize.

Fixed

• Security fixes in the engine: layers, file sharing, DNS forwarding and network relays.
• Kiri recovers by itself after a stale daemon socket.