Configuration

Kickoutchi runs fine with no config file at all. When you want different defaults, drop a small TOML file in place. The repository also ships a copy-ready example covering settings and exact-before-wildcard endpoint labels.

Location

By default Kickoutchi looks in your platform config directory:

Point at a different file with the global --config FILE flag.

Precedence

Settings have layers, like any self-respecting swamp: built-in defaults at the bottom, then the config file, then CLI flags on top. Most keys override their default; protected_processes extends it (see below).

Keys

Every key is optional. Anything you leave out keeps its default.

Config files are capped at 64 KiB. Larger files are rejected instead of being partially parsed or allowed to consume unbounded memory.

Example

refresh_interval_seconds = 5
default_sort = "scope"
hide_system_processes = true
confirm_force_kill = true
protected_processes = ["redis", "mysqld"]

[[ports]]
protocol = "tcp"
address = "127.0.0.1"
port = 3000
label = "web dev"

Endpoint labels

5432 is a port number. postgres is a name you’ll recognise at 2am. Each [[ports]] block gives one endpoint a label that then follows it through the CLI table, sufficiently wide TUI tables, plain search, filters, list --json, snapshots, watch events, and why output.

[[ports]]
protocol = "tcp"
address = "127.0.0.1"
port = 3000
label = "web dev"

[[ports]]
protocol = "tcp"
address = "*"
port = 3000
label = "web service"

[[ports]]
protocol = "udp"
address = "fe80::1"
scope_id = 3
port = 5353
label = "mDNS"

Matching rules:

• Exact beats wildcard. With both blocks above, 127.0.0.1:3000 resolves to web dev and any other address on TCP 3000 resolves to web service.
• IPv4-mapped IPv6 addresses normalize to IPv4 before duplicate detection and matching.
• Hostnames, DNS names, CIDR ranges, interface names, and %zone syntax are rejected. Use scope_id for an IPv6 scope.
• Duplicate selectors are an error, not a last-one-wins surprise.

Up to 256 selectors are accepted.

Protected processes

protected_processes is additive: your names are added on top of the built-in safety set, never instead of it. Adding redis can’t accidentally strip protection from systemd or postgres.

Matching is exact • case-sensitive on Linux/macOS, case-insensitive on Windows • and never a substring, so postgres-backup-helper doesn’t inherit postgres’s protection. Linux also accepts the kernel’s 15-byte /proc/<pid>/comm truncation for longer protected names when that is the only process name available.

The built-in list covers load-bearing processes whose accidental termination takes your containers, database, init system, or desktop with them:

docker, docker.exe, dockerd, dockerd.exe, docker-proxy, docker-proxy.exe,
Docker Desktop.exe, com.docker.backend, com.docker.backend.exe, postgres,
postgres.exe, systemd, System, smss.exe, csrss.exe, wininit.exe, services.exe,
lsass.exe, svchost.exe, winlogon.exe, explorer.exe, dwm.exe, WindowServer

The list is capped at 256 entries and rejects empty names. See Safety for the checks applied to protected processes at kill time.

Hiding system processes

With hide_system_processes = true, the default view drops conservative system/service rows: PID 0 and 1, direct children of PID 1, and a short list of well-known OS process names (plus PID ≤ 4 and children of services.exe on Windows). It’s deliberately cautious • a protected app like postgres is not treated as a system process just because it’s protected; those are two different ideas.