[{"data":1,"prerenderedAt":493},["ShallowReactive",2],{"project-43096477":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":36,"aspects":37,"strip":48,"post_text":51,"what":52,"said":99,"maker_in_thread":268,"shape":281,"grid":286,"attempts":455,"same_week":456,"maker_shows":41,"maker_hidden":485,"reader_version":486,"card":487},"43096477","Subtrace","Wireshark for Docker Containers","title","Show HN: Subtrace – Wireshark for Docker Containers","https:\u002F\u002Fgithub.com\u002Fsubtrace\u002Fsubtrace","github.com","adtac",1739921357,2025,369,73,131,3837,4,"legend","dev_tools","network request inspector","cli",[24,25,26,27,28],"http request inspector","docker debugging","tls interception","seccomp bpf","production debugging","mixed",-0.077,{"positive":32,"neutral":33,"mixed":34,"critical":35},9,20,2,12,43,{"privacy":38,"idea":40,"design":42,"execution":44,"docs":45,"performance":46,"pricing":47},{"positive":39,"critical":34},1,{"positive":34,"critical":41},8,{"positive":39,"critical":43},0,{"positive":18,"critical":34},{"positive":39,"critical":43},{"positive":43,"critical":43},{"positive":43,"critical":43},[49,39,49,49,39,39,39,39,49,49,50,39,49,49,49,49,49,43,49,50,50,39,43,50,49,39,49,49,50,39,43,49,49,43,49,50,49,43,43,43],3,5,"Hey HN, we built Subtrace (https:\u002F\u002Fsubtrace.dev) to let you see all incoming and outgoing requests in your backend server—like Wireshark, but for Docker containers. It comes with a Chrome DevTools-like interface.  Check out this video: https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=OsGa6ZwVxdA, and see our docs for examples:  https:\u002F\u002Fdocs.subtrace.dev.\n\nSubtrace lets you see every request with full payload, headers, status code, and latency details. Tools like Sentry and OpenTelemetry often leave out these crucial details, making prod debugging slow and annoying. Most of the time, all I want to see are the h",{"problem":53,"audience":59,"pricing":67,"motivation":73,"time_to_build":77,"stack":78,"openness":97,"stage":98,"team_size":97},{"value":54,"source":55,"evidence":56},"Seeing HTTP request headers and payloads in production backend servers without excessive logging","maker",[57],{"id":58},"post",{"value":60,"source":61,"evidence":62},"Developers debugging backend servers, including those running in Docker and Kubernetes","inferred",[63,64],{"id":58},{"id":65,"by":11,"text":66},"43106954","Subtrace already works great on Kubernetes (https:\u002F\u002Fdocs.subtrace.dev\u002Fkubernetes)! Add a single line to your image's Dockerfile and that's it. I'm working on an even simpler way…",{"value":68,"source":55,"evidence":69},"Flat pricing with unlimited requests in the cloud; on-prem option for enterprises",[70],{"id":71,"by":11,"text":72},"43118422","Flat pricing with unlimited requests hosted in the cloud (https:\u002F\u002Fsubtrace.dev\u002Fpricing). We also have an on-prem version of Subtrace for enterprises. It runs in their own AWS…",{"value":74,"source":55,"evidence":75},"Prod debugging with Sentry and OpenTelemetry leaves out crucial request details",[76],{"id":58},null,[79,83,87,91],{"value":80,"source":55,"evidence":81},"Linux seccomp BPF",[82],{"id":58},{"value":84,"source":55,"evidence":85},"WebSocket",[86],{"id":58},{"value":88,"source":55,"evidence":89},"TypeScript",[90],{"id":58},{"value":92,"source":55,"evidence":93},"ClickHouse",[94],{"id":95,"by":11,"text":96},"43105415","More than 0.01 ms, less than 0.10 ms. Noticeable when you're a high frequency trading firm, probably not otherwise :) In the hot path, Subtrace is just a dumb proxy that copies…","unknown","launched",{"praise":100,"objections":134,"requests":178,"questions":207,"alternatives":226},[101,116,127],{"value":102,"source":103,"evidence":104},"Automatic TLS decryption without library hooks via injected ephemeral CA is clever","commenter",[105,109,113],{"id":106,"by":107,"text":108},"43105428","hassleblad23","Wow. I think more network inspection tools should adopt an approach like this. Great job.",{"id":110,"by":111,"text":112},"43111647","chatmasta","This is a great hack. It won’t work 100% of the time but it’ll be close, and damn it’s just so clean. Proxies and intercepts all the way down… I love this.",{"id":114,"by":11,"text":115},"43105380","Yes, but we've managed to do it automatically without any library\u002Flanguage specific hooks! It's probably one of my favourite things in Subtrace :) We generate an ephemeral TLS…",{"value":117,"source":103,"evidence":118},"Useful for debugging HTTP traffic with Chrome DevTools interface",[119,123],{"id":120,"by":121,"text":122},"43105583","choilive","Always wanted a tool like this. Will try it out next time I need to inspect traffic of a docker container.",{"id":124,"by":125,"text":126},"43114516","Vordimous","This will help those developers who don't want to navigate Wireshark's setup and just want the familiar Chrom DevTools. Very cool project!",{"value":128,"source":103,"evidence":129},"Server-Timing header support is useful",[130],{"id":131,"by":132,"text":133},"43105798","arguflow","Very happy subtrace user here. Especially useful to possess the Server-Timing headers.",[135,149,164,171],{"value":136,"source":103,"evidence":137},"Wireshark comparison is misleading since Wireshark already works with Docker",[138,142,145],{"id":139,"by":140,"text":141},"43109805","jolmg","My first impression with \"Wireshark for Docker containers\" is \"... Well, Wireshark already works with Docker containers, so if your goal is to be Wireshark for Docker containers,…",{"id":143,"by":111,"text":144},"43111633","I can already use Wireshark itself with docker containers. IMO the real UX problem is that there’s nothing in between “Wireshark” and “DevTools.” What would be cool is a program…",{"id":146,"by":147,"text":148},"43112680","Mekoloto","Wireshark is a weird choice in my opinion because you know, why would i use Subtrace if i can use Wireshark? and People who don't know how to use Wireshark want probably a better…",{"value":150,"source":103,"evidence":151},"Sending data to subtrace.dev is a privacy concern for production secrets",[152,156,160],{"id":153,"by":154,"text":155},"43113870","gerwim","Looks great! Reading through the docs it seems the subtrace process sends all data to your server. I'm reluctant to do that on a production environment, where API keys and…",{"id":157,"by":158,"text":159},"43109094","johannes1234321","From the video it seems the dashboard is hosted on sibtrace.dev. Is my data being sent there? That's an absolute no-go for me.",{"id":161,"by":162,"text":163},"43115499","IggleSniggle","My most painful debugging scenarios with Docker networking (for me) has always been dealing with non-TCP traffic. But still, this seems useful. One thing I don't understand is…",{"value":165,"source":103,"evidence":166},"Wrapping the process with subtrace run seems risky compared to attaching to an interface",[167],{"id":168,"by":169,"text":170},"43111359","beardedwizard","I'm struggling to understand why I wouldn't just use wireshark and specify the interface as well. Reading docs shows you need to invoke your container with this as a wrapper…",{"value":172,"source":103,"evidence":173},"Certificate pinning and embedded root stores can break interception",[174],{"id":175,"by":176,"text":177},"43106699","Arnavion","This will not work with HPKP but hopefully nothing is using that any more. ( https:\u002F\u002Fen.m.wikipedia.org\u002Fwiki\u002FHTTP_Public_Key_Pinning ) It won't work with programs that…",[179,186,193,200],{"value":180,"source":103,"evidence":181},"Fully self-hosted option and server-side source availability",[182,183],{"id":153,"by":154,"text":155},{"id":184,"by":154,"text":185},"43127034","That would work for a single instance, but when running multiple (e.g., you are horizontally scaled) it would not be ideal. Is it possible to mimic \"subtrace.dev\"? There's the…",{"value":187,"source":103,"evidence":188},"Windows Server support",[189],{"id":190,"by":191,"text":192},"43115596","sirjaz","Any Windows Server support coming?",{"value":194,"source":103,"evidence":195},"Kubernetes support with simpler setup",[196],{"id":197,"by":198,"text":199},"43106766","polithrow22","anything similar for k8s?",{"value":201,"source":103,"evidence":202},"PCAP export",[203],{"id":204,"by":205,"text":206},"43109396","conradev","Can I download a pcap file? Being able to view and debug the application protocol is one thing, but I can use Wireshark to view and debug TCP itself. Reading the documentation…",[208,215,222],{"value":209,"source":103,"evidence":210},"Does it add latency to requests",[211],{"id":212,"by":213,"text":214},"43104820","Onkar-Hanchate","Interesting! How does this handle latency? Does it introduce any noticeable delay?",{"value":216,"source":103,"evidence":217},"Can it decrypt TLS traffic",[218],{"id":219,"by":220,"text":221},"43104857","smw","Can it decrypt tls? Perhaps by hooking the calls to common libraries?",{"value":223,"source":103,"evidence":224},"Does the license permit self-hosting the full stack",[225],{"id":184,"by":154,"text":185},[227,238,248,255,261],{"value":228,"source":103,"evidence":229},"Wireshark and Stratoshark",[230,234],{"id":231,"by":232,"text":233},"43109214","rob_c","or, there's you know... wireshark...",{"id":235,"by":236,"text":237},"43105604","kristopolous","stratoshark, the docker container part of wireshark, may be a better match for that description. I'd probably use a postman related pitch instead. This is much closer to that and…",{"value":239,"source":103,"evidence":240},"Pixie",[241,245],{"id":242,"by":243,"text":244},"43115396","ddelnano","Disclaimer: I'm a maintainer of the project Pixie [1] is a similar project and offers the self hosted model you are looking for. We also support 11 application protocols [2] with…",{"id":246,"by":243,"text":247},"43108519","Disclaimer: I'm a maintainer of the project Pixie (https:\u002F\u002Fpx.dev) can be installed in under 5 mins and gives this level of visibility across all applications. No need to change…",{"value":249,"source":103,"evidence":250},"mitmproxy",[251],{"id":252,"by":253,"text":254},"43104925","29athrowaway","You can use mitmproxy and mitmweb to achieve the same. It is in Docker hub and you can pass environment variables to your other containers to make it work. The TLS certificate…",{"value":256,"source":103,"evidence":257},"Kubeshark",[258],{"id":259,"by":220,"text":260},"43118244","kubeshark [0] is using ebpf to catch calls to openssl\u002Fgo's tls lib and thus no need to juggle certs. Has pros and cons compared to your method, but an interesting comparison. [0]…",{"value":262,"source":103,"evidence":263},"Treblle",[264],{"id":265,"by":266,"text":267},"43112593","withinboredom","We use https:\u002F\u002Ftreblle.com\u002F at work for this in production. Very handy to see what requests are being made and by whom.",{"comments":269,"answered":270,"key":271},19,15,[272,275,278],{"id":273,"text":274},"43118227","re self-hosting: yep! Use the -devtools flag to get a stripped down version of Subtrace running entirely locally: ``` subtrace run -devtools=\u002Fsubtrace -- python3 -m http.server…",{"id":276,"text":277},"43108688","Thanks! re the Wireshark analogy: the reason I used that was because: (1) Subtrace operates at roughly the same level in the operating system stack, (2) has similar capabilities,…",{"id":279,"text":280},"43106370","For now, yes :) Since we operate at the TCP level, we can actually handle pretty much any protocol. I have an implementation of a postgres handler in my git stash that intercepts…",{"commenters":282,"max_depth":283,"maker_replies":269,"first_comment_mins":284,"lifespan_hours":285},46,6,1084,62,[287,289,291,295,296,297,301,303,305,306,307,308,310,313,314,317,320,321,323,325,328,332,335,337,340,341,343,345,348,349,351,354,356,357,359,361,365,367,370,372,374,376,379,380,382,385,387,391,393,394,398,400,403,404,407,410,413,418,419,421,423,425,427,428,429,432,435,436,439,443,445,449,451],[153,43,49,288,154,43],"project\u002Fneutral\u002Fprivacy",[242,43,39,290,243,43],"project\u002Fcritical\u002Fidea",[292,43,43,293,294,43],"43115943","commenter\u002Fneutral\u002Fnone","edoceo",[273,43,43,288,11,39],[184,43,49,288,154,43],[298,39,49,299,300,43],"43107465","project\u002Fmixed\u002Fidea","qwertox",[276,39,43,302,11,39],"project\u002Fneutral\u002Fidea",[204,39,49,304,205,43],"project\u002Fneutral\u002Fnone",[139,39,39,290,140,43],[168,39,39,290,169,43],[146,39,39,290,147,43],[143,39,49,309,111,43],"project\u002Fneutral\u002Fdesign",[311,34,39,290,312,43],"43106111","jgauth",[279,34,43,302,11,39],[315,34,49,299,316,43],"43107097","sophacles",[318,34,43,319,11,39],"43107396","maker\u002Fpositive\u002Fnone",[219,49,49,288,220,43],[114,49,43,322,11,39],"project\u002Fneutral\u002Fexecution",[106,49,50,324,107,43],"project\u002Fpositive\u002Fexecution",[326,49,49,322,327,43],"43105948","cyberax",[329,49,39,330,331,43],"43112658","project\u002Fcritical\u002Fexecution","1oooqooq",[333,49,49,288,334,43],"43105989","memhole",[336,49,43,288,11,39],"43106088",[338,49,50,339,334,43],"43106156","project\u002Fpositive\u002Fprivacy",[175,49,39,330,176,43],[342,49,43,322,11,39],"43106868",[344,49,49,322,111,43],"43111657",[346,49,43,347,11,39],"43111986","other\u002Fneutral\u002Fnone",[259,49,49,322,220,43],[350,49,49,322,243,43],"43118481",[352,49,49,322,353,43],"43107159","TachyonicBytes",[355,49,43,322,11,39],"43107430",[110,49,50,324,111,43],[157,18,39,358,158,43],"project\u002Fcritical\u002Fprivacy",[360,18,43,288,11,39],"43110029",[362,18,50,363,364,43],"43110271","project\u002Fpositive\u002Fdocs","zekenie",[120,50,50,366,121,43],"project\u002Fpositive\u002Fidea",[368,283,49,302,369,43],"43107705","ksdme9",[371,283,43,302,11,39],"43108147",[161,373,39,358,162,43],7,[375,373,43,339,11,39],"43118274",[377,41,50,324,378,43],"43114840","mhils",[131,32,50,324,132,43],[381,32,43,319,11,39],"43105849",[383,32,49,322,384,43],"43107346","ayewo",[252,386,39,290,253,43],10,[388,389,39,290,390,43],"43121865",11,"parliament32",[212,35,49,392,213,43],"project\u002Fneutral\u002Fperformance",[95,35,43,392,11,39],[395,396,49,302,397,43],"43111581",13,"kylegalbraith",[399,396,43,302,11,39],"43118366",[124,401,50,402,125,43],14,"project\u002Fpositive\u002Fdesign",[235,270,39,290,236,43],[405,270,43,347,406,43],"43106100","westurner",[408,270,43,347,409,43],"43110919","mdaniel",[411,270,43,347,412,43],"43111563","dang",[414,415,49,416,417,43],"43112127",16,"project\u002Fneutral\u002Fpricing","thebabayaga29",[71,415,43,416,11,39],[265,420,49,302,266,43],17,[190,422,49,322,191,43],18,[424,422,43,293,11,39],"43118476",[231,269,43,426,232,43],"other\u002Fcritical\u002Fidea",[197,33,49,302,198,43],[65,33,43,324,11,39],[430,33,50,366,431,43],"43107215","robinhoodexe",[433,33,43,434,11,39],"43107561","maker\u002Fpositive\u002Fidea",[246,33,49,302,243,43],[437,33,43,347,438,43],"43109330","ZloyKrys",[440,441,43,347,442,43],"43109280",21,"codegeek",[444,441,43,347,412,43],"43111524",[446,441,43,447,448,43],"43111720","other\u002Fcritical\u002Fnone","0xbadcafebee",[450,441,43,347,412,43],"43111904",[452,453,43,347,454,43],"43105523",22,"vednig",[],[457,462,467,471,476,480],{"id":458,"name":459,"points":460,"category":461},"43086479","Tintin 'What a week, huh?' live meme",834,"games",{"id":463,"name":464,"points":465,"category":466},"43041827","SQL Noir",463,"learning_science",{"id":468,"name":469,"points":470,"category":20},"43090214","Scripton",449,{"id":472,"name":473,"points":474,"category":475},"43103073","Mastra",442,"ai",{"id":477,"name":478,"points":479,"category":20},"43048027","CodeWeaver",281,{"id":481,"name":482,"points":483,"category":484},"43071934","ChillyATC",201,"productivity",false,"v2",{"id":488,"name":5,"line":6,"ai":485,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":489,"top":18,"kw":490,"maker":11,"domain":10,"tier":19,"attempts":43,"strip":491,"url":9,"mix":492,"praise":102,"objection":136,"sub":21},43096477,-0.08,[24,25,26,27,28],"3133111133513333303551053133510330353000",[32,33,34,35],1794036669925]