dsnitch

dsnitch is a lightweight, single-binary network and DNS egress inspector designed specifically for Docker containers. It leverages modern Linux eBPF technology to provide real-time visibility into all outbound network activity from containers, including TCP/UDP connections, ICMP pings, and DNS queries, without requiring any modifications to container network stacks, sidecar containers, or heavy telemetry daemons. The tool attaches passive in-kernel eBPF probes directly to the host's unified cgroup v2 hierarchy and the kernel's TCP socket state tracepoint. It intercepts outbound connection requests, Layer-3 ICMP pings, and raw DNS wire payloads on port 53, correlating sockets to Docker container metadata and resolved hostnames in userspace via lockless BPF ring buffers with near-zero CPU overhead (under 1%). Key features include zero-touch container attribution through direct cgroup v2 attachment, in-kernel DNS snooping with userspace Hickory DNS decoding for full CNAME chain resolution, deterministic stateful socket tracking using kernel memory pointers (skaddr) for collision-free tracking across concurrent connections and network namespaces, native ICMP protocol support, dual destination and physical IP columns showing both DNS-resolved hostnames and underlying edge IP endpoints, and intelligent glibc noise filtering that skips dummy POSIX getaddrinfo() UDP port 0 route-lookup probes. The interactive split-pane TUI built with Ratatui provides a container hierarchy tree with live connection counters on the left and a real-time color-coded egress stream on the right, with instant search filtering, container locking, and host traffic toggling. A headless streaming mode (-s) supports non-interactive plain-text output for logging, CI/CD pipelines, or piping to other CLI tools. Installation is straightforward: prebuilt binaries are available for x86_64 and ARM64 Linux architectures, or the tool can be built from source using the Rust nightly toolchain with the rust-src component. The tool requires Linux kernel 5.8+ with unified cgroups v2 and BTF enabled, plus access to the Docker daemon. For unprivileged users, dsnitch recommends using setcap to grant minimal Linux capabilities (cap_sys_admin, cap_net_admin, cap_dac_read_search) so any user in the docker group can run it without sudo. Alternatively, it can be run with standard sudo escalation. The tool includes both in-memory unit tests and an automated end-to-end integration test suite that runs against live Docker containers. The project is licensed under GNU General Public License v3.0 and is maintained by Infomaniac.