Looks great! Reading through the docs it seems the subtrace process sends all data to your server. I'm reluctant to do that on a production environment, where API keys and personal data are being handled.
Is there any way to run it completely self hosted? If not, are there plans? And how will you monitize self hosted options (if it's possible)?
My most painful debugging scenarios with Docker networking (for me) has always been dealing with non-TCP traffic. But still, this seems useful. One thing I don't understand is why this requires an account token? Does this require a network connection to subtrace? It seems like this should all be running locally, and these kinds of connection details are _exactly_ the kind I would not want to leave the host, let alone go to a third party.
Congrats on the seccomp-based interception, that's a really neat way to solve this problem! We did some BPF_PROG_TYPE_CGROUP_SOCK eBPF shenanigans in mitmproxy for redirection, but that doesn't work with containers at all. Cool to see that intercepting all relevant syscalls works that well.
Have not played around with it, but, curious, how does debugging on production work for a specific request/session? Can I filter by some sort if request trace id or something?
So "tcpdump as a service"? Why wouldn't I just generate my own pcap and stick it into wireshark or whatever I like for looking at packet captures? I'm having trouble seeing the value prop here.
You can use mitmproxy and mitmweb to achieve the same. It is in Docker hub and you can pass environment variables to your other containers to make it work.
The TLS certificate setup is more tricky but that is always going to be a pain.
Burp Proxy is another great tool that is even more powerful but harder to set up.
Show HN: Subtrace – Wireshark for Docker Containers
(github.com)357 points by adtac 18 February 2025 | 73 comments
Comments
Is there any way to run it completely self hosted? If not, are there plans? And how will you monitize self hosted options (if it's possible)?
But it really looks useful and I'll definitely play with it to see if I put it into my toolbox.
The TLS certificate setup is more tricky but that is always going to be a pain.
Burp Proxy is another great tool that is even more powerful but harder to set up.
I'd probably use a postman related pitch instead. This is much closer to that and looks like a nice complement to that workflow