| ▲ | Show HN: Dsnitch – Real-time, zero-config Docker egress inspector via eBPF(github.com) | ||||||||||||||||
| 5 points by infomaniac777 a day ago | 3 comments | |||||||||||||||||
Hi HN, I built dsnitch because I wanted a zero-config, bandwhich-style live TUI to see what my homelab Docker containers are connecting to—without running sidecar proxies, modifying container configs, or relying on reverse DNS (fails on anycast CDN IPs). Just run the binary and it automatically discovers running containers. Under the hood, it's written in Rust and attaches eBPF probes to the unified cgroup v2 hierarchy and TCP state tracepoints. To map IPs back to domain names accurately, it passively snoops raw UDP/53 DNS responses per cgroup and decodes them in userspace using Hickory DNS. The terminal interface is built with Ratatui. It targets Linux 5.8+ and does not modify or filter network packets in any way. It's strictly read-only. Happy to answer questions or hear your feedback! | |||||||||||||||||
| ▲ | coder-pm 18 hours ago | parent [-] | ||||||||||||||||
This is great, I was already doing research in that area for my tool. What about a container that writes to the /etc/hosts? It won’t emit DNS queries at all and because of that the connections will show up as bare IPs without domain. That’s a known trick, already exploited (collusion.wiki mentioned here on HN two days ago) | |||||||||||||||||
| |||||||||||||||||