Nicheloom visits: 58,257 all-time · 7,637 in the last 7 days

The opportunity tracker for new startups.

Today: 1,008 launches · Niche of the day: specialized calculation tools · See what launched today →

Dsnitch

Real-time, zero-config Docker egress inspector via eBPF

Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.

Want to reach these readers? Sponsor an issue.

Hi HN, I built dsnitch because I wanted a zero-config, bandwhich-style live TUI to see what my homelab Docker containers are connecting to—without running sidecar proxies, modifying container configs, or relying on reverse DNS (fails on anycast CDN IPs). Just run the binary and it automatically discovers running containers.Under the hood, it's written in Rust and attaches eBPF probes to the unified cgroup v2 hierarchy and TCP state tracepoints. To map IPs back to domain names accurately, it passively snoops raw UDP/53 DNS responses per cgroup and decodes them in userspace using Hickory DNS. The terminal interface is built with Ratatui.It targets Linux 5.8+ and does not modify or filter network packets in any way. It's strictly read-only.Happy to answer questions or hear your feedback!

HN · launched Sep 6, 2026 · 5 upvotes (top 87%) · 0 views

Niche: network monitoring and diagnostics tools · 193 launches, 11 in the last 7 days ▼ -35% · Explore this niche →

Category and tags
  • Horizontal
  • Observability & eval
  • Developer
  • Not AI
  • Commercial product

Visit website ↗ Source listing ↗

More like this: all 193 launches in network monitoring and diagnostics tools →

Could you build this?

No Writing an eBPF-based container egress sniffer requires deep Linux kernel programming, bpf bytecode verification expertise, network socket filtering, and C/Rust low-level systems engineering.

What it would actually take: The architecture requires C or Rust (e.g., Aya/libbpf) writing eBPF programs attached to kernel tracepoints/kprobes (like sock:inet_sock_set_state or cgroup skb egress) coupled with a user-space daemon to parse Docker cgroup namespaces and match network flows to container IDs. The hard parts are kernel verifier constraints, zero-overhead packet inspection, and Docker cgroup v1/v2 translation without sidecars. This requires specialized Linux systems/networking kernel engineering expertise.

Discussion

3 comments analyzed.

Concerns raised: DNS name mapping doesn't work with Docker Compose user-defined networks, Containers using /etc/hosts bypass DNS queries, showing only bare IPs, Hardcoded IPs inside containers won't have DNS name resolution

Competitors

Other products that read as similar to this one : 366 launches clear the similarity bar, closest 8 shown.

Attention rank: #330 of 367 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).

Launched 311 days after the earliest competitor.

  • CargoWall · hn · 2026-03-31 · 14 upvotes · similarity 0.56
  • Cerberus · hn · 2025-12-20 · 12 upvotes · similarity 0.56
  • Netfence · hn · 2026-01-25 · 58 upvotes · similarity 0.51
  • D.NIX. · ph · 2026-09-20 · 2 upvotes · similarity 0.49
  • Nomina · hn · 2026-06-28 · 6 upvotes · similarity 0.49
  • Linnix · hn · 2025-11-11 · 21 upvotes · similarity 0.47
  • Nucleus · hn · 2026-06-09 · 40 upvotes · similarity 0.45
  • Zerobox · hn · 2026-03-30 · 141 upvotes · similarity 0.44

Related data

The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.