This will help those developers who don't want to navigate Wireshark's setup and just want the familiar Chrom DevTools. Very cool project!
Show HN: Subtrace – Wireshark for Docker Containers
61–70 of 75 posts
Re: Show HN: Subtrace – Wireshark for Docker Containers
#62Congrats on the seccomp-based interception, that's a really neat way to solve this problem! We did some BPF_PROG_TYPE_CGROUP_SOCK eBPF shenanigans in mitmproxy for redirection, but that doesn't work with containers at all. Cool to see that intercepting all relevant syscalls works that well.
Re: Show HN: Subtrace – Wireshark for Docker Containers
#63Looks great! Reading through the docs it seems the subtrace process sends all data to your server. I'm reluctant to do that on a production environment, where API keys and personal data are being handled. Is there any way to run it completely self hosted? If not, are there plans? And how will you monitize self hosted options (if it's possible)?
Disclaimer: I'm a maintainer of the project
Pixie [1] is a similar project and offers the self hosted model you are looking for.
We also support 11 application protocols [2] with TLS handshake tracing and MQTT support coming soon (encrypted traffic tracing has been supported for a long time).
[1] https://px.dev
Re: Show HN: Subtrace – Wireshark for Docker Containers
#64My most painful debugging scenarios with Docker networking (for me) has always been dealing with non-TCP traffic. But still, this seems useful. One thing I don't understand is why this requires an account token? Does this require a network connection to subtrace? It seems like this should all be running locally, and these kinds of connection details are _exactly_ the kind I would not want to leave the host, let alone go to a third party.
Re: Show HN: Subtrace – Wireshark for Docker Containers
#65Any Windows Server support coming?
Re: Show HN: Subtrace – Wireshark for Docker Containers
#66Looks great! Reading through the docs it seems the subtrace process sends all data to your server. I'm reluctant to do that on a production environment, where API keys and personal data are being handled. Is there any way to run it completely self hosted? If not, are there plans? And how will you monitize self hosted options (if it's possible)?
Disclaimer: I'm a maintainer of the project Pixie [1] is a similar project and offers the self hosted model you are looking for. We also support 11 application protocols [2] with TLS handshake tracing and MQTT support coming soon (encrypted traffic tracing has been supported for a long time). [1] https://px.dev [2] https://docs.px.dev/reference/datatables/
From a dictionary: The meaning of DISCLAIMER is a denial or disavowal of legal claim : relinquishment of or formal refusal to accept an interest or estate.
Perhaps you meant DISCLOSURE
Re: Show HN: Subtrace – Wireshark for Docker Containers
#67Looks great! Reading through the docs it seems the subtrace process sends all data to your server. I'm reluctant to do that on a production environment, where API keys and personal data are being handled. Is there any way to run it completely self hosted? If not, are there plans? And how will you monitize self hosted options (if it's possible)?
re self-hosting: yep! Use the -devtools flag to get a stripped down version of Subtrace running entirely locally:
subtrace run -devtools=/subtrace -- python3 -m http.server
Re: Show HN: Subtrace – Wireshark for Docker Containers
#68Earlier quoted context omitted.
This will not work with HPKP but hopefully nothing is using that any more. ( https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning ) It won't work with programs that defensively validate the cert chain but those are rare. It won't work with programs that embed their own root cert store, which is also rare but I would guess less rare than the previous one. The usual reason to do this is to minimize OS deps, and in t…
Yep, certificate pinning is the one scenario Subtrace can't handle in my experience, but thankfully, it's fairly rare like you said. And IMO there is no general solution to the problem [1], but it's one of those very interesting problems to daydream thinking about when you're stuck in traffic or whatever :) We still try our best by handling as much of the long tail of environments with some library/framework specific…
kubeshark [0] is using ebpf to catch calls to openssl/go's tls lib and thus no need to juggle certs. Has pros and cons compared to your method, but an interesting comparison.
Re: Show HN: Subtrace – Wireshark for Docker Containers
#69My most painful debugging scenarios with Docker networking (for me) has always been dealing with non-TCP traffic. But still, this seems useful. One thing I don't understand is why this requires an account token? Does this require a network connection to subtrace? It seems like this should all be running locally, and these kinds of connection details are _exactly_ the kind I would not want to leave the host, let alone…
One of my litmus tests for software is "can I use it on a flight?", so you'll be pleased to know Subtrace works great locally without ever talking to subtrace.dev!
subtrace run -devtools=/subtrace -- python3 -m http.server
Re: Show HN: Subtrace – Wireshark for Docker Containers
#70Do you envision going beyond just network calls from bpf?
What would you like to see?
One of things we're thinking about is automatic method/function call tracing. Something like attaching the entire stack trace of calls done to handle the API request. Ideally using the same UI so that you can see the headers/payload that was sent and the function-level stack trace right next to each other. None of the OpenTelemetry verbosity, all of the observability!