Alternatives
Products that do what Dsnitch – Real-time, zero-config Docker egress inspector via eBPF does
A single-binary, lightweight, zero-configuration, real-time terminal UI (TUI) network and DNS egress inspector for Docker containers powered by modern Linux eBPF. - infomaniac777/dsnitch
- 1TN
Trayce (https://github.com/evanrolfe/trayce_gui) is an open source desktop application which monitors HTTP(S) traffic to Docker containers on your machine. It uses EBPF to achieve zero-configuration sniffing of TLS-encrypted traffic. As a backend developer I wanted something which was similar to Wireshark or the Chrome network tab, but which intercepted requests & responses to my containers for debugging in a local dev environment. Wireshark is a great tool but it seems more geared towards lower level networking tasks. When I'm developing APIs or microservices I dont care…
2024 · trayce.dev
- 2CD
2022 · github.com
- 3NL
To power the firewalling for our agents so that they couldn't contact arbitrary services, I build netfence. It's like Envoy but for eBPF filters. It allows you to define different DNS-based rules that are resolved in a local daemon to IPs, then pushed to the eBPF filter to allow traffic. By doing it this way, we can still allow DNS-defined rules, but prevent contacting random IPs. There's also no network performance penalty, since it's just DNS lookups and eBPF filters referencing memory. It also means you don't have to tamper with the base image, which the agent could potentially manipulate…
Jan 2026 · github.com
- 4
- 5SW
Hey HN, we built Subtrace (https://subtrace.dev) to let you see all incoming and outgoing requests in your backend server—like Wireshark, but for Docker containers. It comes with a Chrome DevTools-like interface. Check out this video: https://www.youtube.com/watch?v=OsGa6ZwVxdA, and see our docs for examples: https://docs.subtrace.dev. Subtrace lets you see every request with full payload, headers, status code, and latency details. Tools like Sentry and OpenTelemetry often leave out these crucial details, making prod debugging slow and annoying. Most of the…
2025 · github.com
- 6IG
Hey all, wanted to share my recent weekend hack project. I wanted to improve upon the existing space for looking up information about IP addresses and ASNs. The backend is written in Rust and pulls BGP data every 8 hours from the RIPE RIS project to build up a routing table and also adds geolocation information. The frontend is using React and Tailwind. Would love any feedback or suggestions on what to improve.
2023 · ip.guide
- 7PK
2025 · github.com
- 8WY
May 2026 · github.com
- 9WA
eBPF is an amazing technology that allows safely running user-supplied functions at pretty much arbitrary probe points in a kernel/user space context. Much has been written about how amazing this feature is for kernel observability. But as someone who writes user space code, what I find even more amazing is the support for tracing arbitrary user space programs, with no code changes and low overhead. However, doing in-depth analysis can get complicated and time-consuming. My goal with wachy was to make this debugging significantly easier/faster to use, by displaying traces in a TUI…
2022 · rubrikinc.github.io
- 10
- 11NM
A real-time network connection monitoring tool built with Rust and GTK4, displaying active connections with live I/O statistics in a modern graphical interface. https://github.com/grigio/network-monitor
Nov 2025
- 12ZS
I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds additional functionalities like secret injection, SDK, etc. Watch the demo: https://www.youtube.com/watch?v=wZiPm9BOPCg Zerobox follows the same sandboxing policy as Deno which is deny by default. The only operation that the command can run is reading files, all writes and network I/O are blocked by default. No VMs, no Docker, no remote servers. Want to block reads to /etc? zerobox…
Mar 2026 · github.com
- 13IB
I found it odd there wasn’t a simple web tool to scan Docker Hub images for vulnerabilities. So I built one. It’s powered by the popular open-source tool Trivy.
2023 · containercve.com
- 14
- 15GM
2024 · github.com
- 16CE
We just open-sourced CargoWall - a lightweight eBPF firewall for GitHub Actions. We originally built it to stop LLM agents from connecting to untrusted domains. After recent GitHub Actions supply chain compromises like the Trivy attack, we realized it'd work well for blocking untrusted connections from CI runners too. It uses iptables DNAT to redirect all outbound port 53 traffic to a local DNS proxy, which checks each query against a hostname allowlist before forwarding. Resolved IPs from allowed responses are inserted into eBPF LPM trie maps, and a TC egress classifier attached to the…
Mar 2026 · github.com
- 17PA
2022 · elesiuta.github.io
- 18CR
Hi HN! I'm Mo, a platform engineer at Deltaflare working on critical infrastructure protection. I built Cerberus because traditional packet capture tools (tcpdump, Wireshark) have too much overhead for production CNI environments. eBPF lets us filter and classify packets at the kernel level with near-zero performance impact. Some interesting challenges: - eBPF verifier is strict - every memory access needs bounds checking - Limited to 32 bytes of L7 payload (tradeoff between inspection depth and overhead) - TC vs XDP decision (chose TC for compatibility) Looking for contributors, especially…
Dec 2025 · github.com
- 19AO
Hello Everyone, I'm excited to introduce a new open-source observability platform and would love to hear your feedback. We are aware that there are lots of open-source/commercial tools out there. However, we believe that monitoring the clusters and extracting actionable insights requires deep know-how about the tools/domain. We mainly focused on this problem. - Alaz is an eBPF agent installed on your K8s cluster as DaemonSet. Thanks to eBPF, Alaz collects traces directly from Linux kernels. This means there's no need for sidecars, instrumentations, or service restarts. - The UI not…
2023 · github.com
- 20
A fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code. Daemonless: a real, kernel-enforced container in ~3.5 ms from an OCI image, out of one static binary - getkern/kern
14d ago · github.com
- 21SD
Most site blockers work by blacklisting distractions. That never worked for me, the internet is too big, and there’s always something new to waste time on. I wanted the opposite: allowlist‑only browsing. Block everything by default, and explicitly allow only what I need. So I built Sinkzone: a local DNS forwarder with two modes: Monitor mode: lets all traffic through, but logs every domain so you can decide what to allow. Focus mode: only allowlisted domains resolve; everything else is blocked (NXDOMAIN). It’s open source, written in Go, and runs locally on macOS, Linux, and Windows. Works a…
2025 · github.com
- 22SA
2025 · github.com
- 23KE
2022 · github.com
- 24IM
I made a Terminal UI for OpenSnitch[1], an interactive application firewall for Linux inspired by Little Snitch. I’ve always wanted to create a TUI and found the perfect excuse to make this for usage on one of my headless servers. I wrote this in Rust to force myself to learn more, viz. async features. Super open to feedback and contributions! [1] https://github.com/evilsocket/opensnitch
Nov 2025 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →