Wireshark seems a bit misleading. More like a "network inspector" if one leans towards the browser's network tab in the inspector?
But it really looks useful and I'll definitely play with it to see if I put it into my toolbox.
Show HN: Subtrace – Wireshark for Docker Containers
31–40 of 75 posts
Re: Show HN: Subtrace – Wireshark for Docker Containers
#32Earlier quoted context omitted.
Subtrace already works great on Kubernetes ( https://docs.subtrace.dev/kubernetes )! Add a single line to your image's Dockerfile and that's it. I'm working on an even simpler way where you can just `kubectl apply` a DaemonSet or a Helm chart to get automatic tracing for all pods in your cluster instantly without any code-level changes. If anyone is interested in beta testing this, email me at adtac@subtrace.dev, I'd…
It’d be neat to use subtrace in an ephemeral pod for debugging purposes, that just runs alongside the regular pod. For monitoring the network traffic for the whole cluster, the CNI and/or whatever ebpf-based runtime security stuff you’re using (falco, tetragon, tracee) is usually enough, but I can definitely see the usefulness of subtract for more specific debugging purposes. If run as a DaemonSet make sure to add so…
> use subtrace in an ephemeral pod for debugging purposes
That's a great suggestion. It'd be like kubectl exec-ing into a shell inside the pod, but for network activity. I think I'm going to prototype this tonight :)
> pod filtering such as namespace and label selectors
Yep, Subtrace already tags each request with a bunch of metadata about the place where it originated so that you can filter on those in the dashboard :) Things like the hostname, pod, cluster, AWS/GCP location are automatically populated, but you can also set custom tags in the config [1].
Re: Show HN: Subtrace – Wireshark for Docker Containers
#33Have not played around with it, but, curious, how does debugging on production work for a specific request/session? Can I filter by some sort if request trace id or something?
Re: Show HN: Subtrace – Wireshark for Docker Containers
#34Have not played around with it, but, curious, how does debugging on production work for a specific request/session? Can I filter by some sort if request trace id or something?
You can tag each request with arbitrary key-value maps and search over these later. For example, if you add a `x-subtrace-tags: user=foo, project=bar` header on the response, you can apply a `tags.user == "foo"` filter in the dashboard to see all requests across your entire infra from that user and only that user. Each request is pre-populated by default with tags like hostname, pod name, AWS/GCP location, etc.
It's like Honeycomb's wide events but even better because: (1) you can see whole request including the payload alongside the event fields, and (2) it's fully automatic and requires no code changes out of the box (you can incrementally add these tags when you find a need for each one instead of the huge upfront cost from instrumenting the hell out of your codebase).
Re: Show HN: Subtrace – Wireshark for Docker Containers
#35anything similar for k8s?
Disclaimer: I'm a maintainer of the project
Pixie (https://px.dev) can be installed in under 5 mins and gives this level of visibility across all applications. No need to change your application (wrap in `subtrace run`) to get instant visibility.
We also support 11 application protocols (https://docs.px.dev/reference/datatables/) with TLS handshake tracing and MQTT support coming soon (encrypted traffic tracing has been supported for a long time).
Re: Show HN: Subtrace – Wireshark for Docker Containers
#36Wireshark seems a bit misleading. More like a "network inspector" if one leans towards the browser's network tab in the inspector? But it really looks useful and I'll definitely play with it to see if I put it into my toolbox.
Thanks!
re the Wireshark analogy: the reason I used that was because: (1) Subtrace operates at roughly the same level in the operating system stack, (2) has similar capabilities, (3) has an overlap in use-cases, and (4) has been the most effective at communicating what Subtrace is in my experience so far. I can see why the analogy is not a perfect 1:1 mapping (obligatory xkcd: https://xkcd.com/624), but naming things is hard and taglines are just names in idea space :)
Re: Show HN: Subtrace – Wireshark for Docker Containers
#37From the video it seems the dashboard is hosted on sibtrace.dev. Is my data being sent there? That's an absolute no-go for me.
Re: Show HN: Subtrace – Wireshark for Docker Containers
#38or, there's you know... wireshark...
Re: Show HN: Subtrace – Wireshark for Docker Containers
#39Side question. Why not do a Launch HN instead of Show HN since you are backed by YC ? I thought YC companies can do a launch HN?
Re: Show HN: Subtrace – Wireshark for Docker Containers
#40anything similar for k8s?
Might be an overkill to use it in this capacity but SUSE NeuVector (https://github.com/neuvector/neuvector) can build a connectivity graph between pods and allows to perform packet capture to PCAP. It works at the virtual switch layer and can capture all traffic.