What is cloudd on Mac?

What cloudd does

cloudd lives at /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd and runs as your user. Apps don’t talk to iCloud servers directly: they hand their records to CloudKit, and cloudd does the uploading, downloading, retrying, conflict handling and caching.

Things that commonly go through it:

• Messages in iCloud, Notes, Reminders, Calendar parts, Contacts parts
• Safari bookmarks, Reading List, tab groups and history
• Passwords and Keychain-related data, Health, Home, Freeform
• Third-party apps that use CloudKit for sync (many note, task and journaling apps)

iCloud Drive files are handled by bird. Background transfers of large assets may run through nsurlsessiond.

Why it gets busy

• Signing in to iCloud on a new Mac: years of messages and notes download at once.
• Turning on Messages in iCloud: often the heaviest one. Attachments are large and numerous.
• A sync loop: an app that keeps writing the same records, or a record that keeps failing and retrying.
• Account or network trouble: an expired session, a full iCloud storage plan, or a proxy blocking Apple’s servers causes constant retries.

How to make it calm down

Find which app is behind it. CloudKit logs the container name, which includes the app’s bundle ID:

/usr/bin/log stream --process cloudd --style compact | grep -oE 'iCloud\.[A-Za-z0-9.-]+|com\.apple\.[A-Za-z0-9.-]+' | head -40

Or measure its traffic:

nettop -P -L 1 -p cloudd

Then:

1. Check System Settings › [your name] › iCloud for a full-storage warning. A full plan makes uploads fail and retry.
2. Turn off sync for the app that keeps appearing, wait a minute, and turn it back on.
3. For Messages, let the first sync finish on Wi-Fi with the Mac plugged in.
4. Quit cloudd in Activity Monitor if it seems stuck; it restarts cleanly.
5. If its cache is huge, quit cloudd and delete ~/Library/Caches/CloudKit, then restart. Data re-downloads as needed.

When to worry

The real cloudd runs as you from the CloudKitDaemon.framework path. Check:

ps -o user,pid,command -p $(pgrep -x cloudd)

A process named cloudd anywhere else (your home folder, /Users/Shared, /tmp) should be inspected with codesign -dv --verbose=2 <path>. Constant uploads when you haven’t changed anything are worth a look in iCloud settings, but they’re almost always a sync bug, not data theft.

Seeing it in Stat Space

Stat Space tracks bytes per network interface per day for 90 days, so you can see whether cloudd’s busy afternoon cost 200 MB or 20 GB. With Pro, per-app network splits that by app, and “who’s phoning home” lists the hosts each one connected to.