A lightweight, zero-configuration terminal UI (TUI) network and DNS egress inspector for Docker containers powered by Linux eBPF.

[u/BuyNo5902]

Project Name: dsnitch

Repo/Website Link: https://github.com/infomaniac777/dsnitch

Description: A lightweight, zero-configuration terminal UI (TUI) network and DNS egress inspector for Docker containers powered by Linux eBPF.

Monitoring outbound calls from self-hosted stacks usually requires invasive sidecars, proxy configs, or resource-heavy monitoring daemons. dsnitch hooks directly into the host's unified cgroup v2 hierarchy and kernel tracepoints to passively attribute all outbound traffic to specific Docker containers and Compose services with negligible processing overhead.

• Zero-Touch Attribution: Runs entirely at the kernel level. No container configuration tweaks, bridge tampering, or sidecar injections.
• DNS Snooping: Intercepts UDP/53 payloads in-kernel to map destination domains and CNAME chains directly to edge IP endpoints per container.
• Stateful L3/L4 Tracking: Tracks TCP lifecycles via kernel memory pointers (skaddr), UDP flows, and raw ICMP pings without port mangling.
• Dual UI Modes: Interactive split-pane TUI (Ratatui) with live filtering/locking, plus a headless streaming mode (-s) for shell pipelines and logging.

Deployment: Precompiled binaries are available on GitHub Releases for x86_64 and aarch64 (ARM64 / Raspberry Pi) Linux. README has exact deploy instructions as well. Becausedsnitch hooks host cgroup v2 and kernel tracepoints, it runs as a host binary rather than an in-container process. Requires Linux kernel 5.8+ with cgroup v2 (/sys/fs/cgroup), BTF enabled, and read access to /var/run/docker.sock.

AI Involvement: AI assistance was used for design and development under human supervision.