What platforms does witr support?

witr runs on Linux, macOS, FreeBSD, and Windows, and is distributed as a single static binary for each.

Can I try witr without installing it?

Yes. The project hosts a browser-based sandbox with a simulated Linux box and a guided tutorial, no install required.

Does witr work with Docker and Kubernetes?

Yes. witr is container-aware and traces the causal chain through supervisors and containers, which is relevant on Docker hosts and Kubernetes nodes.

What license is witr released under?

witr is licensed under Apache-2.0.

How is witr different from tools like ps, lsof, or docker ps?

Those tools show the current state of processes, ports, or containers, but leave you to manually infer causality. witr traces and presents the actual chain of what started a process, port, container, or file.

Can I get machine-readable output for scripting?

Yes, witr can output JSON in addition to human-readable text and its interactive TUI, making it usable in scripts and automation.

witr: Trace any process, port, container

witr answers one question: why is this running? It's built for engineers, SREs, and anyone doing incident response who needs to trace a process, an open port, a container, or a file back to the exact chain of systems that caused it to exist. Instead of manually correlating output from ps, lsof, ss, systemctl, and docker ps, witr walks the causal chain (supervisor, container, service, shell) and presents it as one readable answer, machine-readable JSON, or an interactive TUI dashboard.

The tool targets the gap between tools that show what is running and the actual question of why it's running. That distinction matters most during incident response, when you're staring at an unfamiliar process or an open port and need to know its origin fast, without stitching together five different command outputs by hand.

Key features

Causal tracing: follows a process, port, container, or file back through the chain of supervisors, containers, services, and shells responsible for starting it.
CLI and TUI modes: run a single command for a quick answer, or launch the interactive TUI dashboard for exploration.
Machine-readable output: emit JSON for scripting, automation, or feeding into other tooling.
Cross-platform binary: ships as a single static binary for Linux, macOS, FreeBSD, and Windows.
Container-aware: understands Docker and container-level context as part of the causal chain, not just host-level processes.
No dependencies to install: distributed as a static binary through a wide range of package managers (Homebrew, Conda, APT, AUR, Winget, npm, FreeBSD Ports, and more) or a direct install script.
Browser sandbox: a hosted, guided tutorial and free-play environment lets you try witr against a simulated Linux box before installing anything.

Ideal use cases

witr fits incident response and general systems debugging where you need to trace something running back to its origin: an unexpected process consuming CPU, a service bound to a port you don't recognize, a container that keeps respawning, or a file whose provenance is unclear. It's useful on servers, in Kubernetes nodes, and on developer machines running Docker, where the chain from init system to supervisor to container to process can span several layers.

It's a good fit for on-call engineers and DevOps teams who currently rely on manually cross-referencing ps, lsof, ss, systemctl, and docker ps output during an incident. The JSON output also makes it usable inside scripts or automated diagnostics.

It's not the right tool if you need deep performance profiling, resource usage graphing, or continuous monitoring and alerting. witr answers a causal "why is this running" question at a point in time; it doesn't replace monitoring stacks, APM tools, or log aggregation systems.

Installation

witr ships as a single static binary for Linux, macOS, FreeBSD, and Windows, and is also packaged across many ecosystems (check current packaging status on Repology).

Quick install on Unix (Linux, macOS, FreeBSD):

curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash

Quick install on Windows (PowerShell):

irm https://raw.githubusercontent.com/pranshuparmar/witr/main/install.ps1 | iex

Via Homebrew (macOS & Linux):

brew install witr

Via APT (Ubuntu 26.04+, Debian sid and later):

sudo apt install witr

Via Conda:

conda install -c conda-forge witr

From source, with Go installed:

go install github.com/pranshuparmar/witr/cmd/witr@latest

This places the witr binary in $GOPATH/bin or $HOME/go/bin; make sure that directory is in your PATH.

Additional package managers are supported, including MacPorts, AUR, Winget, npm, FreeBSD Ports, Chocolatey, Scoop, AOSC OS, GNU Guix, Uniget, Aqua, Brioche, and Mise, along with prebuilt .deb, .rpm, and .apk packages from the GitHub releases page.