witr: Trace Any Process, Port, or Container Back to Its Source

My notes

Summary

witr is a single static-binary CLI/TUI that answers “why is this running?”. It traces any process, port, container, or open file back to the causal chain that started it (systemd, launchd, docker, pm2, cron, SSH session, and others), instead of leaving you to manually correlate ps, lsof, ss, and systemctl output. It runs on Linux, macOS, Windows, and FreeBSD with no dependencies.

Key Insight

• Core mechanic: witr treats everything as a process question. Ports, files, containers, and service names all resolve to a PID, then witr walks the ancestry tree to find the single primary “source” (systemd unit, launchd job, docker container, pm2, cron, SSH session, tmux/screen) responsible for it existing.
• Output modes matter for scripting: --json, --short (ancestry only), --tree (child processes, up to 10), --env, --warnings, --verbose, and it returns meaningful exit codes (0 clean, 1 warnings, 2 not found, 3 permission denied, 4 invalid input, 5 internal error) so it slots directly into CI and monitoring scripts via case $? in.
• Target flags are repeatable and mixable: --pid, --port, --file, --container can all be combined with positional name args in one invocation, and results print with labeled dividers in the order typed.
• Built-in warning heuristics beyond “what is running”: flags root processes, dangerous Linux capabilities (CAP_SYS_ADMIN and similar on non-root), public bind addresses (0.0.0.0 and ::), over 1GB RSS, over 90 days uptime, deleted binaries, and LD_PRELOAD/DYLD_* injection indicators. Useful as a fast incident-response triage layer.
• Container-aware across the whole zoo: Docker, Podman, nerdctl, K8s/crictl, Incus, LXC, LXD, and FreeBSD jails in one --container lookup, matching name, image, command, or compose project/service label.
• Platform-native, not a wrapper: on Windows it talks to Win32 APIs directly (ToolHelp32, PSAPI, Service Control Manager) rather than spawning PowerShell or WMI, explicitly to avoid the slow Get-CimInstance startup hang.
• No-install trial path: offers a simulated Linux box in-browser (guided tutorial plus free-play sandbox) so you can see the tool’s output before installing anything.