FAQ

FAQ

Where is the download?

On GitHub Releases. Flotilla 1.5.0-beta.5 is in beta, and each release is signed with Developer ID and notarised, as a DMG, a .pkg for MDM and scripted installs, and a zip and a tarball of the same app. After the first install an admin Mac updates itself. See Requirements and install, or build it from source — it is two commands.

Is it free? Is it open source?

Both.

Free to use: no account, no sign-in, no telemetry, no subscription, no paid tier.

Open source under Apache-2.0 — the same licence Apple uses for container itself. You may use, modify and redistribute it, including commercially, provided you keep the notices. It also carries an explicit patent grant, which a permissive licence like MIT does not.

The names and marks are reserved separately and are not covered by the licence: Flotilla, melonfleet, the wordmark and the app icon. Fork the code freely — give the fork its own name and icon, so nobody is left guessing which build they are running. See NOTICE in the repository.

Does it need Docker?

No. It has nothing to do with Docker. It drives Apple's container CLI, which is a different runtime. It can pull images from Docker Hub, and browse it, because that is a registry, not a runtime.

Does it replace container?

No — it requires it. Flotilla builds a command, validates it, runs container, and decodes the JSON. It shows you the exact command it used, so nothing happens that you could not have typed. If container is missing it offers to install Apple's own package, through Apple's Installer.

Why shell out instead of linking Apple's framework?

A recorded decision. Some other GUIs link container's Swift client libraries and talk to the daemon over XPC. Shelling out means the CLI is the single source of truth for behaviour and grammar, every action is reproducible by hand, and the trust boundary is one place — the allowlist — rather than spread through a linked framework. The reasoning and the rejected alternatives are in DECISIONS.md.

Can it manage containers on other Macs?

Yes, since 1.5. One Mac is the admin, and it pairs with host Macs on your own network, with no server in between. The admin can see and manage the hosts' containers, images, volumes, networks and Kubernetes clusters, follow their logs, update their Flotilla, and keep them awake. Machines, terminals and file browsing stay on the Mac you are sitting at. See Hosts.

Does somebody need to be at a host?

Only to set it up. Flotilla must be running in a logged-in user's session, because container needs one; the Mac must be awake and reachable; and its owner must answer macOS's local network prompt once and approve the pairing. A configuration profile cannot answer that prompt. Installing container by itself also needs the Flotilla Helper switched on.

What can an admin do on a host — and not do?

It can run, stop and delete containers, pull and send images, create volumes and networks, manage clusters, read logs, keep the host awake and offer it updates. It can start, stop or restart the host's container only while the host allows that, which it does by default.

It gets no shell, no file access on the host, and no way to mount a host folder into a container. Every request is checked against the host's own allowlist before it runs. See Security model.

How many hosts can I add?

Flotilla sets no limit, and its lists and pickers are designed for dozens of Macs rather than three. Each host is asked for its status in turn, so the practical limit is your network. The address plan that gives each Mac its own range for pushed networks has room for 256 Macs.

Are hosts found outside my local network?

Not automatically. Bonjour finds hosts on the same network. Across a VPN or a routed subnet, add a host by a name such as mini.lan or an address such as 10.0.1.20; Flotilla keeps the typed address and uses it wherever Bonjour cannot see the host.

Can containers on two Macs talk to each other?

Through published ports only. Each Mac's networks are its own, and Flotilla does not join them. DNS can give a container on one Mac a name the others resolve, but only a published port answers there. See DNS.

Does pushing a volume copy its files?

No. Push to Hosts creates an empty volume of the same name on each host. A pushed network is a separate network on each Mac, with its own address range. See Volumes and networks.

Is it a Kubernetes thing?

Not at heart. Flotilla manages containers on Macs; it is not an orchestrator and not a scheduler. It does surface container k8s — Apple's own experimental clusters — in a Kubernetes section, on this Mac and on hosts. Those clusters need Rosetta, container 1.5 cannot restart one (only recreate it), and kubectl on the admin cannot reach a cluster on a host yet. See Kubernetes.

Does it keep my registry passwords?

No. The password lives in the form only while it is open, is handed to container registry login --password-stdin, and is cleared. container keeps the resulting credential in the Keychain; Flotilla never stores it.

Does it send anything anywhere?

Nothing about you or your Mac. It fetches nothing at launch — even the wordmark is drawn in SwiftUI rather than loaded as a webfont, specifically so an app that promises no phone-home does not request a font from a CDN.

It does reach the network for reasons you can name: on an admin Mac, Sparkle reads Flotilla's update feed, and asks once before it does so by itself; Docker Hub is asked when you open its browser; Apple's package is downloaded when you install container; and other Macs are reached only once paired. Settings ▸ About lists every address and when.

What is a .flotilla file?

A configuration export: what to build — groups, containers, networks, volumes, machines, clusters, the hosts to pair again, and optionally tags, the registry list and DNS domains. Another Mac pulls the same images and creates the same things, empty, after you review them. It holds no passwords, no volume data and no image layers. It is a newer, versioned format than the Flotillafile, which describes machines and containers. See Sharing and export.

Will it be on the Mac App Store?

Not planned. Distribution is Developer ID with notarisation.

Intel Macs?

No. Apple's container runtime requires Apple silicon and macOS 26, so Flotilla does too.

Why is a setting greyed out?

Most often because your organisation manages it: a locked setting shows a lock and says so. Some depend on another, such as anything that needs the Flotilla Helper while it is off, and the row says which. What you will not find is a control that persists and changes nothing — the build fails if a setting marked available has no code reading it. See Settings.

Is the AI thing part of the app?

No. Flotilla was built hand-in-hand with an AI assistant, and that is a fact about how it was written, not a feature of it. There is no AI in the app, no MCP server, no model integration, and nothing phones a model at runtime.

How many tests are there?

Around 870 at the time of writing, across the Foundation-only core and the fleet's trust and network layers. Run swift test for the current number rather than trusting that one. The app layer has no test target — which is why decisions that matter are pushed down into the core, and why some invariants are enforced by script instead.

What is planned for 2.0?

See the Not yet note at the foot of Home. Nothing in it is part of 1.5.