stratoshark, the docker container part of wireshark, may be a better match for that description.
I'd probably use a postman related pitch instead. This is much closer to that and looks like a nice complement to that workflow
Show HN: Subtrace – Wireshark for Docker Containers
11–20 of 75 posts
Re: Show HN: Subtrace – Wireshark for Docker Containers
#12Very happy subtrace user here. Especially useful to possess the Server-Timing headers.
Re: Show HN: Subtrace – Wireshark for Docker Containers
#13Very happy subtrace user here. Especially useful to possess the Server-Timing headers.
standards ftw!
Re: Show HN: Subtrace – Wireshark for Docker Containers
#14Can it decrypt tls? Perhaps by hooking the calls to common libraries?
Yes, but we've managed to do it automatically without any library/language specific hooks! It's probably one of my favourite things in Subtrace :) We generate an ephemeral TLS root CA certificate and inject it into the system store. The generated certificate is entirely in-memory and never leaves the machine. To make this work without root privileges, we intercept the open(2) syscall to see if it's /etc/ssl/certs/ca-…
I can't decide if I'm horrified or amazed by this :)
Re: Show HN: Subtrace – Wireshark for Docker Containers
#15Can it decrypt tls? Perhaps by hooking the calls to common libraries?
Yes, but we've managed to do it automatically without any library/language specific hooks! It's probably one of my favourite things in Subtrace :) We generate an ephemeral TLS root CA certificate and inject it into the system store. The generated certificate is entirely in-memory and never leaves the machine. To make this work without root privileges, we intercept the open(2) syscall to see if it's /etc/ssl/certs/ca-…
Up front, this is not my area of expertise. You would still not want to run this on the same server as your containers since someone could inject their own cert? I think it allows someone to decrypt traffic that isn't just proxied to Subtrace?
Edit: I've reviewed the docs and it looks like you do run it on the same server. For clarity, I've used Sentry before.
Re: Show HN: Subtrace – Wireshark for Docker Containers
#16Earlier quoted context omitted.
Yes, but we've managed to do it automatically without any library/language specific hooks! It's probably one of my favourite things in Subtrace :) We generate an ephemeral TLS root CA certificate and inject it into the system store. The generated certificate is entirely in-memory and never leaves the machine. To make this work without root privileges, we intercept the open(2) syscall to see if it's /etc/ssl/certs/ca-…
Up front, this is not my area of expertise. You would still not want to run this on the same server as your containers since someone could inject their own cert? I think it allows someone to decrypt traffic that isn't just proxied to Subtrace? Edit: I've reviewed the docs and it looks like you do run it on the same server. For clarity, I've used Sentry before.
Subtrace proxies the program's connection using a regular TLS connection to the upstream server. For example, if you do `subtrace run -- curl https://example.com`, curl thinks it's talking to example.com over TLS, but it's really talking to Subtrace locally. Since we injected the ephemeral root CA into the system store, curl will trust the valid TLS certificate that Subtrace presents for example.com. From within the same server, Subtrace will handle the actual TLS connection to upstream example.com. That upstream connection is undecipherable to outsiders.
Everything is exactly as secure as before Subtrace. In other words, using Subtrace doesn't make the NSA's job any easier ;)
Re: Show HN: Subtrace – Wireshark for Docker Containers
#17stratoshark, the docker container part of wireshark, may be a better match for that description. I'd probably use a postman related pitch instead. This is much closer to that and looks like a nice complement to that workflow
Stratoshark: https://wiki.wireshark.org/Stratoshark :
> Stratoshark captures and analyzes system calls and logs using libsinsp and libscap, and can share capture files with the Sysdig command line tool and Falco
Re: Show HN: Subtrace – Wireshark for Docker Containers
#18Looks like it is for http requests only? If so, wireshark is not an apt comparison.
Re: Show HN: Subtrace – Wireshark for Docker Containers
#19Earlier quoted context omitted.
Up front, this is not my area of expertise. You would still not want to run this on the same server as your containers since someone could inject their own cert? I think it allows someone to decrypt traffic that isn't just proxied to Subtrace? Edit: I've reviewed the docs and it looks like you do run it on the same server. For clarity, I've used Sentry before.
Subtrace proxies the program's connection using a regular TLS connection to the upstream server. For example, if you do `subtrace run -- curl https://example.com `, curl thinks it's talking to example.com over TLS, but it's really talking to Subtrace locally. Since we injected the ephemeral root CA into the system store, curl will trust the valid TLS certificate that Subtrace presents for example.com. From within the…
That's helpful! Thanks for clarifying. I'll have to check it out.
Re: Show HN: Subtrace – Wireshark for Docker Containers
#20Looks like it is for http requests only? If so, wireshark is not an apt comparison.
For now, yes :)
Since we operate at the TCP level, we can actually handle pretty much any protocol. I have an implementation of a postgres handler in my git stash that intercepts and shows the SQL queries executed + the resulting rows alongside the HTTP request that triggered it (I still need to do some robustness and correctness testing before it's ready to merge). With a handful of other protocols like MySQL, Mongo, Redis, Kafka, or even FTP lol, I think Subtrace can cover most practical dev workloads.
Btw Subtrace can already record .pcap files today since it's just a simple TCP stream proxy, but raw network packet captures are mostly only useful when you're implementing new protocols, which 99% of the people using Docker containers today aren't doing. It's also a solved problem because you can just run `apt-get install tcpdump` inside the container.
Automatic tracing for app-level protocols that is easy to setup, works everywhere, lightweight for prod, fast to search, and can show the data in a clean interface is still insanely difficult today. That's the problem Subtrace is trying to solve.