The box serves a folder around the clock. Your computer mounts it on demand, wherever it is.
A KEIBIDROP session needs both machines online. A NAS or a home server is online all the time, so it can be the serving side: footage on the studio box, the archive in the rack, a working folder reachable from any laptop. The box shares the folder. Your computer mounts it with the KEIBIDROP app and reads it on demand, end to end encrypted. Only the bytes a program reads cross the wire. Files that land in the served folder while a computer is connected, from an FTP upload or a card copy, show up on that computer within a minute.
The container holds the serving side only, so it runs on plain Docker with the stock kernel and standard container permissions. The driver (macFUSE, fuse3 or WinFsp) lives on the machine that reads the files, your computer, set up per the install guides.
| Item | Requirement |
|---|---|
| Container runtime | Docker or compatible. TrueNAS SCALE, Unraid, Synology Container Manager (x86), QNAP Container Station, or any Linux host. Images exist for amd64 and arm64. |
| Network | Host networking. The peer needs the box's real ports and its IPv6 address for a direct connection. With bridge networking every connection goes through the KeibiDrop bridge instead. |
| Ports | TCP 26431 inbound and 26432 outbound by default. UDP 26431 inbound carries the QUIC control lane for small reads; without it the session stays on TCP. Change the ports only if another KEIBIDROP peer on the same box uses them, and keep them inside 26000-27000. |
| Folders | The folder to serve, and a private folder for the box's identity. |
First, on your computer, open the KEIBIDROP app, keep Local mode off and press Copy my code. That is your computer's code. Then, on the box, save this as docker-compose.yml. Set the path of the folder to serve, paste your computer's code into KD_PEER and start it:
services:
keibidrop:
image: ghcr.io/keibisoft/keibidrop:latest
container_name: keibidrop
restart: unless-stopped
network_mode: host
environment:
KD_PEER: "" # your computer's code, from Copy my code
KD_PEER_NAME: laptop
KD_SHARE_READ_ONLY: "false"
volumes:
- /path/to/your/files:/shares
- keibidrop-config:/config
volumes:
keibidrop-config:
docker compose up -d docker compose logs -f
The log prints the box's own code. That is the whole configuration on the box. On Unraid, open the Apps tab and search for KeibiDrop in Community Applications; the template exposes the same settings. On Synology Container Manager or QNAP Container Station, search the registry for keibisoft/keibidrop, the copy on Docker Hub. The image is also ghcr.io/keibisoft/keibidrop, published with each release since 0.4.4 for amd64 and arm64. docker build -f docker/Dockerfile -t keibidrop:local . builds it from the repository as well.
docker compose logs and press Connect.~/KeibiDrop/Mount/ by default; Settings shows the path. Open the files from there in any app. For DaVinci Resolve, follow edit from a NAS in DaVinci Resolve.If the box started with KD_PEER empty, give it your computer's code while it runs:
docker exec keibidrop kd add-contact laptop <your computer's code>
From then on, both sides reconnect by themselves after a drop. The box connects only to the contact you saved. Its code survives restarts as long as you keep the folder mapped to /config. When your computer connects, the box's log prints Peer connected and the path: direct, bridge or lan.
Camera to box: Sony, Canon and Nikon bodies send each shot over FTP to a Synology or a QNAP at the studio, or a card reader drops the cards into a folder on the box. That folder is the one the laptop sees.
Photos: Lightroom Classic adds the raws from the folder in place, with Add instead of Copy; the catalog and the previews stay on the laptop. Capture One works the same way with referenced files.
Video: DaVinci Resolve, Premiere Pro and Final Cut Pro point their media at the folder; the project library, the project file or the Final Cut library stays on the laptop. Scrubbing pulls the parts of the clip you touch. Edit from a NAS in DaVinci Resolve goes step by step, and the video and audio guide has the details per application.
Archive: a home server keeps the archive on the box with the share set read only, and every computer in the house mounts it.
With KD_SHARE_READ_ONLY: "true", the box refuses every change your computer sends. Add :ro to the folder mount as well, so the container cannot write to the folder at all:
volumes:
- /path/to/your/files:/shares:ro
Share a folder read only shows how to check the files with hashes before and after a session.
The folder mapped to /config holds the box's private identity key and its contacts. The key file is mode 0600, and the container refuses to start when the folder is readable by other users. Anyone who can read the folder can act as the box, so keep it out of shared backups or encrypt those backups. Passphrase protection of the identity needs a terminal at every start, so the container does not offer it; use the desktop app where you want that protection.
The container runs as uid 1000. If the served folder belongs to another user, run the container as that user with user: "<uid>:<gid>" in the compose file.
With host networking and IPv6 on both ends, the connection is direct. When one side blocks inbound connections, which is the normal state of a laptop on home WiFi, the traffic goes through the bridge, which forwards encrypted bytes it cannot read. A direct connection never uses relay credit; bridged traffic rides the free tier until credit is added. KD_STRICT: "true" turns the fallback off and fails the connection instead. The full picture, including a self-hosted relay, is in work through firewalls and the network and ports reference.
/config/config.toml; environment variables win over the file.