DWatchtower

DWatchtower is a powerful, terminal-based User Interface (TUI) for dynamic analysis and monitoring of Docker containers in real time. It acts as an interactive sandbox viewer for security researchers, developers, and system administrators who want deep visibility into the internals of a running container without leaving the terminal.

Demo

Features

DWatchtower provides a comprehensive suite of tools built into a tabbed interface. You can navigate through the features using the global shortcuts.

1. Controls

The central hub for starting new Docker sandbox environments. You can easily pull and run an image (like alpine or ubuntu). If you have a specific command to run in the sandbox, you can pass arguments directly via the CLI, e.g., sudo ./DWatchtower docker run -d ....

2. Logs

Real-time streaming of stdout and stderr directly from your sandboxed container.

• Filter/Search: Double-tap / to focus the search bar, type your query, and hit Enter to filter the logs instantly. Hit Esc to clear.

3. Network Capture

Live monitoring of network traffic to and from the container. Under the hood, this uses nsenter and tcpdump to hook into the container's network namespace, capturing packets and translating them into readable network events.

• Filter: Double-tap / to filter by Protocol (TCP/UDP) or IP address.

4. System Calls (Syscalls)

Traces container activity at the kernel level using strace. It observes crucial events like process execution (execve), file operations (open/openat), and socket connections.

• Threat Filter: Toggle with Ctrl+T to only show dangerous or suspicious syscalls.
• Add Custom Syscall: Hit Ctrl+E to add custom syscalls to monitor dynamically.

5. Processes

Live tracking of running processes inside the sandbox (similar to docker top).

• Timeline Playback: DWatchtower records snapshots of the process tree. You can step backward (< or ,) and forward (> or .) through time to see how the process tree evolved during the container's lifecycle. Hit R to return to live tracking.

6. Ports

Quick overview of the exposed container ports and how they map to your host machine.

7. File System (FS) Changes

Monitors and displays diffs/modifications made to the container's filesystem during its runtime. It tracks additions (A), changes (C), and deletions (D).

8. Configuration

Exposes the raw container configuration, including environment variables, entrypoints, and mount bindings, in an easy-to-read format.

9. Interactive Shell

Drops you into a fully functional, interactive shell (bash or sh) directly inside the running container, all within the TUI tab.

Global Shortcuts

• Alt+0 to Alt+8: Instantly jump to a specific tab.
• Alt+Left / Alt+Right: Smoothly navigate between tabs.
• Ctrl+C: Safely request exit (will prompt to remove the running sandbox container before quitting).
• // (Double-tap /): Focus the search/filter bar in supported tabs (Logs, Network, System, FS).

Prerequisites & Dependencies

To take full advantage of DWatchtower, the host system requires the following:

• Docker Engine (with permissions to communicate with the docker socket)
• nsenter: Used to enter the container's namespaces.
• tcpdump: Used for the Network tab capture.
• strace: Used for the System tab syscall monitoring.

Note: Since DWatchtower attaches to namespaces and traces system calls, it often needs to be run with sudo or as root depending on your host configuration.

Getting Started

1. Build the binary:

   go build -o DWatchtower main.go

2. Run it: Launch the interactive UI:

   sudo ./DWatchtower

   Or pass Docker run arguments directly:

   sudo ./DWatchtower docker run -d my-suspicious-image

3. Explore the tabs, monitor the sandbox, and hit Ctrl+C when you're done!