witr: Trace Any Process, Port, or Container Back to What Started It

By Prahlad Menon Published 2026-08-06 2 min read

Ever stared at a mysterious process hogging a port and wondered: what started this thing?

Traditional tools like ps, top, lsof, and ss tell you what is running. But figuring out why — tracing the chain of supervisors, containers, shells, or cron jobs that spawned it — requires manually correlating outputs across multiple tools.

witr (“Why Is This Running?”) makes that causality explicit in a single command.

What It Does

Point witr at a process, PID, port, container, or file and it traces the entire chain that explains it:

Systemd units → which service file started it
Supervisors → supervisord, pm2, etc.
Containers → Docker, Podman, containerd
Shells & terminals → bash/zsh parent chains
Cron jobs → scheduled task origins

Plus: who started it, when, from where, and warnings worth knowing.

Three Ways to Use It

1. Interactive TUI

Run witr with no arguments to get a full-screen dashboard with tabs for Processes, Ports, Containers, and File Locks:

witr

Navigate with arrow keys, drill into any item to see its ancestry chain.

2. CLI One-Liners

# What's using port 8080?
witr -p 8080

# Trace a specific PID
witr 12345

# What started this container?
witr -c my-container

# Who's locking this file?
witr -f /var/run/app.lock

3. Scriptable JSON Output

witr -p 3000 --json

Returns structured JSON with real exit codes — perfect for automation, monitoring scripts, or piping to jq.

Installation

witr is a single static Go binary. Install via your preferred method:

# macOS/Linux (quick install)
curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash

# Homebrew
brew install witr

# apt (Debian/Ubuntu 26.04+)
sudo apt install witr

# Windows (winget)
winget install -e --id PranshuParmar.witr

# Or via Go
go install github.com/pranshuparmar/witr/cmd/witr@latest

Also available via: MacPorts, Conda, AUR, Chocolatey, Scoop, npm, FreeBSD Ports, and more.

Why This Matters

When debugging production issues, the question isn’t just “what’s running” — it’s “how did we get here?” witr collapses what used to be a multi-tool investigation into a single, readable output.

Particularly useful for:

Port conflicts — instantly identify what’s blocking your dev server
Zombie process hunting — trace orphaned processes to their origin
Container debugging — understand the full spawn chain
Incident response — quickly explain unexpected processes

Try It in Your Browser

The project includes a browser-based playground — a simulated Linux box where you can try witr without installing anything.