Skip to content
Search

Subtrace

lastmod 2025-02-21created 2025-02-211 edits

Wireshark for Docker containers

WARNING

Be sure to read the #Hacker News comments section. There seem to be some issues

About

  • A tool that lets you trace every network request made from Docker containers
    • Applies Wireshark's functionality to container environments
  • This lets you analyze a backend server's network traffic in real time and resolve production issues faster

Key features

  • Usable immediately with no configuration
    • Just add subtrace run in front of the backend server's start command
  • No code changes needed
  • Supports all programming languages (Python, Node.js, Go, etc.)
  • Shows a request's full payload, headers, status code, and latency
  • Performance overhead under 100µs
  • Based on Clickhouse
  • Open source

How Subtrace works

  • Intercepts all network-related Linux system calls (syscalls) using Seccomp BPF
  • Proxies TCP connections to analyze HTTP requests and sends them to the browser over WebSocket
  • Requests can be inspected visually using the Network tab of Chrome DevTools
  • Unlike existing log-based tools such as Sentry or OpenTelemetry, you can see every request as-is in real time

Code contributions

  • Subtrace is open source but currently does not accept Pull Requests
  • This is because, as a startup, it runs with a small team and lacks the capacity to manage an open-source community efficiently
  • The policy may change in the future, and feature requests and bug reports are always welcome

Hacker News comments

  • Show HN: Subtrace – Wireshark for Docker Containers | Hacker News
  • Reading the docs, it seems the subtrace process sends all data to a server. I wouldn't want that in a production environment that handles API keys and personal data
    • Wondering if there's a way to run it fully self-hosted. If not, are there plans for it? Also curious how you'd monetize a self-hosted option
  • Wireshark is a bit misleading. It's closer to a "network inspector" that uses the browser's Network tab
    • It looks really useful, and I'll definitely try it to see whether it goes in my toolbox
  • It seems to apply only to HTTP requests. If so, the comparison with Wireshark isn't appropriate
  • The most painful debugging scenario in Docker networking has always been dealing with non-TCP traffic. Still looks useful. What I don't get is why an account token is required. Does subtrace need a network connection? All of this should run locally, and connection details like these should never leave the host
  • Congrats on the seccomp-based interception. It's a really neat way to solve this problem. We did some fun work with BPF_PROG_TYPE_CGROUP_SOCK eBPF in mitmproxy, but it doesn't work in containers at all. Cool to see that intercepting all the relevant system calls works well
  • Wondering if it can decrypt TLS. Probably possible by hooking common library calls
  • Watching the video, the dashboard seems to be hosted on sibtrace.dev. Wondering if my data gets sent there. That's an absolute no
  • Haven't tried it, but my question is how to debug a specific request/session in production. Wondering if you can filter by something like a request trace ID
  • I've always wanted a tool like this. I'll try it next time I need to inspect traffic from a Docker container

See also

Favorite site

author Zer0 sitemap