Show HN: Dsnitch – Real-time, zero-config Docker egress inspector via eBPF

Hi HN, I built dsnitch because I wanted a zero-config, bandwhich-style live TUI to see what my homelab Docker containers are connecting to—without running sidecar proxies, modifying container configs, or relying on reverse DNS (fails on anycast CDN IPs). Just run the binary and it automatically discovers running containers.

Under the hood, it's written in Rust and attaches eBPF probes to the unified cgroup v2 hierarchy and TCP state tracepoints. To map IPs back to domain names accurately, it passively snoops raw UDP/53 DNS responses per cgroup and decodes them in userspace using Hickory DNS. The terminal interface is built with Ratatui.

It targets Linux 5.8+ and does not modify or filter network packets in any way. It's strictly read-only.

Happy to answer questions or hear your feedback!