poodlelab/tracebag

Tracebag is a self-hosted diagnostics tool for .NET applications running in Docker containers. You start it on a server when something goes wrong, use a web browser to investigate logs and runtime behavior, and stop it when the session ends. It collects evidence during an incident and keeps that evidence in a timeline you can review. The tool lets you search container logs, follow live log streams, and watch .NET runtime counters for CPU usage, memory, garbage collection, thread pools, and lock contention. It can also capture stack snapshots, traces, garbage collection dumps, and process dumps, tying each piece of evidence to the incident that prompted it. Tracebag only works with containers that explicitly opt in through Docker labels, and it does not expose a shell or accept arbitrary Docker commands. A debugging session starts with Docker Compose. You open the UI locally or through an HTTPS reverse proxy, collect the evidence you need, then stop the stack. Stopping it removes the component with Docker access, but named volumes preserve captured evidence for future sessions. The supplied Compose file does not restart automatically, though a resident mode is available for continuous collection. Target containers require preparation before an incident. You add Docker labels that enable discovery, logging, and .NET diagnostics, plus a named volume for the runtime diagnostic socket. These labels cannot be added to a running container, so you must configure targets ahead of time. Recreating a container during an investigation could alter the failure state you are trying to diagnose. Tracebag deliberately avoids some things. It does not auto-discover containers, provide browser shell access, or send data to a cloud analysis service. It is not a Kubernetes or distributed tracing platform. While running, its backend has Docker administrator capabilities, even with a read-only socket mount, so the project recommends running it only on a host you control and reading the security model before using it near production workloads. The repository includes a demo workload that generates synthetic CPU pressure, allocations, and other issues for practice. Tracebag is developed with substantial AI assistance, though the maintainer retains responsibility for architecture, security, and releases.