Keybase Filesystem (KBFS)

crypto, distributed-systems, end-to-end-encryption, fuse, go, kbfs, keybase, keybase-filesystem
go get


Keybase Filesystem (KBFS) Build Status Build status

This repository contains the official Keybase implementation of the client-side code for the Keybase filesystem (KBFS). See the KBFS documentation for an introduction and overview.


All code is written in the Go Language, and relies on the Keybase service.


This client allows you to mount KBFS as a proper filesystem at some mountpoint on your local device (by default, /keybase/). It communicates locally with the Keybase service, and remotely with three types of KBFS servers (block servers, metadata servers, and key servers).

The code is organized as follows:

  • dokan: Helper code for running Dokan filesystems on Windows.
  • env: Code to implement libkbfs.Context in terms of libkb.
  • fsrpc: RPC interfaces that connected clients can call in KBFS, to do certain operations, such as listing files.
  • kbfscodec: Interfaces and types used for serialization in KBFS.
  • kbfscrypto: KBFS-specific cryptographic types and functions.
  • kbfsdokan: The main executable for running KBFS on Windows.
  • kbfsfuse: The main executable for running KBFS on Linux and OS X.
  • kbfshash: An implementation of the KBFS hash spec.
  • kbfssync: KBFS-specific synchronization primitives.
  • kbfstool: A thin command line utility for interacting with KBFS without using a filesystem mountpoint.
  • libdokan: Library code gluing together KBFS and the Dokan protocol.
  • libfs: Common library code useful to any filesystem presentation layer for KBFS.
  • libfuse: Library code gluing together KBFS and the FUSE protocol.
  • libkbfs: The core logic for KBFS.
  • metricsutil: Helper code for collecting metrics.
  • test: A test harness with a domain-specific test language and tests in that language.
  • tlf: Code and structures for top-level folders (TLFs).
  • vendor: Vendored versions of the open-source libraries used by KBFS.


KBFS currently works on both Linux (at least Debian, Ubuntu and Arch), OS X, and Windows. It is approaching release ready, though currently it is still in alpha. There may still be bugs, so please keep backups of any important data you store in KBFS. Currently our pre-built packages are available by invitation only.

KBFS depends in part on the following awesome technologies to present a mountpoint on your device:

See our vendor directory for a complete list of open source packages KBFS uses.

Currently, our server implementations are not open source.

To run from source against production KBFS servers

On Linux or OS X:


  • Go 1.7 or higher.
  • A running Keybase client service (see instructions).
  • On OS X, you may have to install FUSE yourself.
    • You may need to pass the --use-system-fuse flag to kbfsfuse if you install FUSE yourself.
  • Then, mount KBFS at /keybase/ as follows:
    cd kbfsfuse
    go install
    mkdir -p /keybase && sudo chown $USER /keybase
    KEYBASE_RUN_MODE=prod kbfsfuse /keybase

Note that our pre-built packages for OS X include a branded version of FUSE for OS X, to ensure that it doesn't conflict with other local FUSE installations. It is still open source -- see here to see how we build it.

On Windows:

See our kbfsdokan documentation.

To run from source against local in-memory servers

kbfsfuse -server-in-memory -localuser strib /keybase

(Use "-server-root <dir> if instead you want to save your data to local disk.)

Now you can do cool stuff like:

ls /keybase/private/strib
echo blahblah > /keybase/private/strib/foo
ls /keybase/private/strib,max

(Note that "localuser" mode has only four hard-coded users to play with: "strib", "max", "chris", and "fred".)

Code style

We require all code to pass gofmt and govet. You can install our precommit hooks to make sure your code passes gofmt and govet:

go get
ln -s $GOPATH/src/ $GOPATH/src/

Though it doesn't happen automatically, we also expect your code to be as "lint-free" as possible. Running golint is easy from the top-level kbfs directory:

go get -u
make lint


KBFS vendors all of its dependencies into the local vendor directory. To add or update dependencies, use the govendor tool, as follows:

go install
govendor add  # or `govendor update`
git add --all vendor


From kbfs/:

go test -i ./...
go test ./...

If you change anything in interfaces.go, you will have to regenerate the mock interfaces used by the tests:

cd libkbfs

(Right now the mocks are checked into the repo; this isn't ideal and we should probably change it.)


Most code is released under the New BSD (3 Clause) License. If subdirectories include a different license, that license applies instead. (Specifically, dokan/dokan_header and most subdirectories in vendor are released under their own licenses.)