Subtrace
Dev tools
network request inspector
SHOW HN2025
How HN took it
9 positive, 20 neutral or asking, 2 mixed, 12 critical, out of 43 comments about the project. Thread score -0.08.
Idea: 2 for, 8 againstExecution: 4 for, 2 againstPrivacy: 1 for, 2 againstDesign: 1 for, 0 againstDocs: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Automatic TLS decryption without library hooks via injected ephemeral CA is clever
From 3 comments
Wow. I think more network inspection tools should adopt an approach like this. Great job.
hassleblad23 on HNThis is a great hack. It won’t work 100% of the time but it’ll be close, and damn it’s just so clean. Proxies and intercepts all the way down… I love this.
chatmasta on HNYes, but we've managed to do it automatically without any library/language specific hooks! It's probably one of my favourite things in Subtrace :) We generate an ephemeral TLS…
adtac on HN
Useful for debugging HTTP traffic with Chrome DevTools interface
From 2 comments
Always wanted a tool like this. Will try it out next time I need to inspect traffic of a docker container.
choilive on HNThis will help those developers who don't want to navigate Wireshark's setup and just want the familiar Chrom DevTools. Very cool project!
Vordimous on HN
Server-Timing header support is useful
From 1 comment
Very happy subtrace user here. Especially useful to possess the Server-Timing headers.
arguflow on HN
Objections
Wireshark comparison is misleading since Wireshark already works with Docker
From 3 comments
My first impression with "Wireshark for Docker containers" is "... Well, Wireshark already works with Docker containers, so if your goal is to be Wireshark for Docker containers,…
jolmg on HNI can already use Wireshark itself with docker containers. IMO the real UX problem is that there’s nothing in between “Wireshark” and “DevTools.” What would be cool is a program…
chatmasta on HNWireshark is a weird choice in my opinion because you know, why would i use Subtrace if i can use Wireshark? and People who don't know how to use Wireshark want probably a better…
Mekoloto on HN
Sending data to subtrace.dev is a privacy concern for production secrets
From 3 comments
Looks great! Reading through the docs it seems the subtrace process sends all data to your server. I'm reluctant to do that on a production environment, where API keys and…
gerwim on HNFrom the video it seems the dashboard is hosted on sibtrace.dev. Is my data being sent there? That's an absolute no-go for me.
johannes1234321 on HNMy most painful debugging scenarios with Docker networking (for me) has always been dealing with non-TCP traffic. But still, this seems useful. One thing I don't understand is…
IggleSniggle on HN
Wrapping the process with subtrace run seems risky compared to attaching to an interface
From 1 comment
I'm struggling to understand why I wouldn't just use wireshark and specify the interface as well. Reading docs shows you need to invoke your container with this as a wrapper…
beardedwizard on HN
Certificate pinning and embedded root stores can break interception
From 1 comment
This will not work with HPKP but hopefully nothing is using that any more. ( https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning ) It won't work with programs that…
Arnavion on HN
Requests
Fully self-hosted option and server-side source availability
From 2 comments
Looks great! Reading through the docs it seems the subtrace process sends all data to your server. I'm reluctant to do that on a production environment, where API keys and…
gerwim on HNThat would work for a single instance, but when running multiple (e.g., you are horizontally scaled) it would not be ideal. Is it possible to mimic "subtrace.dev"? There's the…
gerwim on HN
Windows Server support
From 1 comment
Any Windows Server support coming?
sirjaz on HN
Kubernetes support with simpler setup
From 1 comment
anything similar for k8s?
polithrow22 on HN
PCAP export
From 1 comment
Can I download a pcap file? Being able to view and debug the application protocol is one thing, but I can use Wireshark to view and debug TCP itself. Reading the documentation…
conradev on HN
Questions
Does it add latency to requests
From 1 comment
Interesting! How does this handle latency? Does it introduce any noticeable delay?
Onkar-Hanchate on HN
Can it decrypt TLS traffic
From 1 comment
Can it decrypt tls? Perhaps by hooking the calls to common libraries?
smw on HN
Does the license permit self-hosting the full stack
From 1 comment
That would work for a single instance, but when running multiple (e.g., you are horizontally scaled) it would not be ideal. Is it possible to mimic "subtrace.dev"? There's the…
gerwim on HN
Alternatives named
Wireshark and Stratoshark
From 2 comments
or, there's you know... wireshark...
rob_c on HNstratoshark, the docker container part of wireshark, may be a better match for that description. I'd probably use a postman related pitch instead. This is much closer to that and…
kristopolous on HN
Pixie
From 2 comments
Disclaimer: I'm a maintainer of the project Pixie [1] is a similar project and offers the self hosted model you are looking for. We also support 11 application protocols [2] with…
ddelnano on HNDisclaimer: I'm a maintainer of the project Pixie (https://px.dev) can be installed in under 5 mins and gives this level of visibility across all applications. No need to change…
ddelnano on HN
mitmproxy
From 1 comment
You can use mitmproxy and mitmweb to achieve the same. It is in Docker hub and you can pass environment variables to your other containers to make it work. The TLS certificate…
29athrowaway on HN
Kubeshark
From 1 comment
kubeshark [0] is using ebpf to catch calls to openssl/go's tls lib and thus no need to juggle certs. Has pros and cons compared to your method, but an interesting comparison. [0]…
smw on HN
Treblle
From 1 comment
We use https://treblle.com/ at work for this in production. Very handy to see what requests are being made and by whom.
withinboredom on HN