In development. v0.1 is being built now; early access opens from the waitlist.
snif is a native macOS app that watches the traffic between your Docker Compose services as it happens: who calls whom, how long each call takes, and which one made the whole request slow. No proxy, no SDK, no certificates, no changes to your containers.
Apple Silicon, macOS 27, OrbStack. Docker Desktop and Colima in v0.2.
Start the capture and the map draws itself from real traffic within seconds. Every edge carries its own latency. Every row in the table is a real request, decoded from the wire.
Click an edge to see p50, p95 and p99 for the newest second, five minutes of p95, request rate, errors, open and new connections, retransmits, the busiest methods and the slowest requests still in the buffer.
The service list in the sidebar turns orange when a service is slower than its own recent baseline.
Pick a request and snif rebuilds the calls it caused, downstream through every service. When your services pass traceparent, x-request-id, b3 or grpc-trace-bin, links are certain. When they pass nothing, snif matches calls by timing and says so.
On our demo stack with header propagation switched off, the timing heuristic links 100% of calls correctly with one client and 74% with five concurrent clients. Links marked certain have been correct every time we checked.
Method, status, timing, headers, gRPC trailers with grpc-status and grpc-message, body preview with the full body on demand, and Copy as cURL. HTTP/2 connections opened before the capture started are labelled as such, instead of showing guessed headers.
Decoding protobuf bodies through server reflection or your own .proto files is part of v0.1 and not in the build yet.
Type what you are looking for. Terms combine; a leading minus negates.
svc:payments status:5xx lat>100ms -proto:grpcAlso is:error, src:, dst:, method:, status>=500, lat<=2s and free text.
Chaos is the last large piece of v0.1 and is not in the app yet. Here is what it is for: below, a real capture of the demo stack's pool exhaustion scenario, where payments gets two database connections and twenty clients. The map turns orange and p95 on every hop from loadgen to payments jumps to 3.6 s.
Every fault has a time to live, five minutes by default and sixty at most. It is written to a ledger before it is applied, and every tc and iptables rule carries a snif marker. A janitor removes expired or orphaned rules every ten seconds and on agent restart. Stop all faults is always one click away, and stopping the capture removes everything.
$ snif fault add latency --edge checkout:payments --ms 300 --ttl 2mThe snif CLI is planned for v0.2.
Containers on a Mac run inside a Linux VM, and their traffic to each other never reaches macOS. So snif comes in two parts that talk over a local gRPC connection.
A single Rust binary in a 20 MB image. It reads every packet on the containers' virtual interfaces with AF_PACKET, reassembles TCP, detects the protocol, parses requests and computes latency histograms per edge. On our test machine it uses 5 to 6% of one core and about 80 MB of memory at 1,000 requests per second.
A native Mac app, no Electron. It starts and stops the agent for you, draws the map in SwiftUI Canvas and the request table in AppKit, and keeps 200,000 requests in memory without dropping frames.
Planned for v0.2: the same contract from a terminal, for scripts and CI. Topology as JSON, faults on and off.
snif is not released. Everything marked done below runs today against a real Compose stack; everything else is planned and may change. Open a release to see the detail.
Bar length is the planned amount of work per release, not a calendar. We publish dates once a release is close.
Watching is free, with no time limit. You pay when you act on what you see, keep it, or take it with you. Planned prices for launch, in US dollars.
0 USD
To look around your stack.
89 USD per year
or 9 USD per month. Per developer, up to 3 Macs. 14 day trial.
A team license with shared chaos profiles is planned with v1.0.
A Mac with Apple Silicon on macOS 27, and OrbStack. Docker Desktop and Colima are planned for v0.2. Your services run unchanged in Docker Compose.
No. snif reads packets on the virtual network inside the Linux VM that runs your containers. Nothing sits in the request path and nothing in your images changes.
Container to container traffic never leaves the Linux VM, so macOS cannot see it. The snif agent runs inside that VM with the rights to read the virtual network interfaces and, for chaos, to apply tc and iptables rules in a container network namespace. It listens only on 127.0.0.1 and requires a per session token from the app.
No. Traffic, history and exports stay on your machine. There is no telemetry. The app will connect out only to check for updates and, for Pro, to verify a license, with 30 days of offline grace.
Encrypted traffic shows up as connections with timing, not content. Plaintext through uprobes on OpenSSL, BoringSSL and Go crypto/tls is planned for v0.3. snif will never decrypt by swapping certificates.
Not yet. Native processes as nodes on the map are planned for v0.3, through a small privileged helper on the Mac.
No. snif is commercial software from RealSec. You will get a signed, notarized app and an agent image the app verifies by digest. Trust comes from transparency instead: a public description of what the agent does, and a Transparency panel (v0.2) that logs every network change it makes.
snif lets you see it. Get on the early access list and we will write when the beta opens.