witr: The Open-Source CLI With 19,900+ GitHub Stars That Answers 'Why Is This Running?' in One Command

Every developer has been there: you SSH into a server, open a terminal, and see a process you don't recognize. Maybe it's consuming CPU, bound to a port, or holding a file lock. You run ps aux, then lsof, then systemctl, then docker ps — piecing together clues like a digital detective.

What if one command could answer the question "Why is this running?" completely?

That's exactly what witr does — and it's why nearly 20,000 developers have starred it on GitHub since its launch in December 2025.

What Is witr?

witr (pronounced "with-er," as in "what is it with this process?") is a process tracing tool created by Pranshu Parmar. It traces any running entity — a process, a listening port, a container, or a file lock — back to the exact chain of systems that caused it to exist.

Existing tools show you what is running. witr tells you why it's running.

# What started that nginx process?
$ witr nginx

Process: nginx (PID 2847)
├── Started by: systemctl
│   ├── Service: nginx.service
│   │   ├── Unit file: /etc/systemd/system/nginx.service
│   │   └── Enabled: yes (starts on boot)
│   └── Parent: systemd (PID 1)
└── Listening on: 0.0.0.0:80, 0.0.0.0:443

No more jumping between five different tools. No more guessing. One command, complete answer.

Four Investigation Modes — One Tool

1. Process Tracing

Give witr a process name, PID, or pattern, and it returns the full ancestry tree: what spawned it, what service manages it, and what configuration keeps it alive.

# By name (substring match by default)
$ witr node

# By exact name
$ witr --exact node

# By PID
$ witr --pid 4821

# Multiple PIDs at once
$ witr --pid 4821 --pid 5033

2. Port Investigation

Find out exactly what's listening on a port and trace it back to its origin:

$ witr --port 8080

Port: 8080/tcp (LISTEN)
└── Process: node (PID 4821)
    ├── Command: node dist/server.js
    ├── Working dir: /home/deploy/myapp
    ├── Started by: pm2
    │   └── PM2 app: myapp-api (ecosystem.config.js)
    └── User: deploy

3. Container Tracking

witr understands Docker, Podman, nerdctl, Kubernetes (crictl), Incus, LXC, LXD, and even FreeBSD jails — all in one unified view:

# What's inside that container?
$ witr --container redis-cache

Container: redis-cache
├── Runtime: Docker
├── Image: redis:7-alpine
├── Status: Up 3 days
├── Compose project: myapp-stack
│   └── Compose file: /opt/myapp/docker-compose.yml
├── Ports: 0.0.0.0:6379 -> 6379
└── Started by: systemd (docker-compose@myapp-stack.service)

4. File Lock Detection

Track down which process holds a file lock — the silent killer of deployments and builds:

$ witr --file /var/lib/dpkg/lock-frontend

File: /var/lib/dpkg/lock-frontend
└── Locked by: apt (PID 9182)
    ├── Command: apt upgrade
    ├── Started by: tmux session "server"
    │   └── User: admin (logged in via SSH from 10.0.1.5)
    └── Lock type: FLOCK (exclusive)

The Interactive TUI: Your System at a Glance

Running witr with no arguments (or with -i) launches an interactive Terminal UI with four tabs:

• Processes Tab: Live, sortable, filterable list with ancestry tree side panel
• Ports Tab: Open/listening ports with owning processes — toggle between LISTEN and ALL with a
• Containers Tab: All running containers across every runtime in one unified list
• Locks Tab: System-wide file locks (POSIX/FLOCK on Linux, lsof-derived on macOS/FreeBSD)

The TUI supports mouse navigation, adaptive themes (auto-detects light/dark terminals), auto-refresh, and even lets you send signals (kill, terminate, pause, resume) or renice processes directly from the interface.

Installation: 15+ Package Managers

witr ships as a single static binary with zero dependencies. Install it through your preferred package manager:

# macOS / Linux (Homebrew)
brew install witr

# Debian / Ubuntu (apt)
sudo apt install witr

# Arch Linux (AUR)
yay -S witr-bin

# Windows (Winget)
winget install -e --id PranshuParmar.witr

# Cross-platform (npm)
npm install -g @pranshuparmar/witr

# Cross-platform (conda)
conda install -c conda-forge witr

# Or the universal install script
curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash

It's also available on MacPorts, Chocolatey, Scoop, Nix, Guix, Pixi, Mise, Aqua, Brioche, FreeBSD Ports, and AOSC OS. Check the Repology page for the full packaging status.

Real-World Example: Debugging a Production Server

Imagine you're on-call and your monitoring alerts you: port 9090 is unexpectedly occupied on a production server. Here's how witr resolves it in seconds:

# Step 1: What's on port 9090?
$ witr --port 9090

Port: 9090/tcp (LISTEN)
└── Process: prometheus (PID 3344)
    ├── Config: /etc/prometheus/prometheus.yml
    ├── Started by: systemd
    │   └── Service: prometheus.service (enabled)
    └── Memory: 1.2GB RSS

# Step 2: Who changed the config last?
$ witr --file /etc/prometheus/prometheus.yml

File: /etc/prometheus/prometheus.yml
├── Currently open by: prometheus (PID 3344) [read]
└── Last modified: 2 hours ago by user "deploy-bot"
    └── Via: ansible-playbook site.yml (PID 2901, now exited)

In two commands, you know: Prometheus is on 9090, it's managed by systemd, and its config was changed 2 hours ago by an Ansible deployment. Problem diagnosed.

Key Benefits

• Single source of truth — replaces manual correlation across ps, lsof, ss, systemctl, docker ps, and more
• Causality, not just state — tells you why something is running, not just what is running
• Cross-runtime visibility — Docker, Podman, Kubernetes, LXC, systemd, pm2, supervisord, all unified
• JSON output — pipe into jq, integrate into CI/CD, or feed monitoring dashboards
• Zero dependencies — single static binary, no runtime requirements
• Cross-platform — Linux, macOS, FreeBSD, and Windows with native packaging for 15+ package managers
• Interactive TUI — real-time dashboard with mouse support, auto-refresh, and process management
• Shell completions — tab completion for Bash, Zsh, Fish, and PowerShell
• Open source — Apache 2.0 license, actively maintained, welcoming contributions

How Does witr Compare to Traditional Tools?

FAQ

Is witr free and open source?

Yes. witr is fully open source under the Apache 2.0 license. You can use it in personal and commercial projects without restriction. The source code is available on GitHub.

Does witr work on Windows?

Yes. witr supports Windows with a native binary and is available through Winget, Chocolatey, Scoop, npm, and Conda. It also provides PowerShell completions.

Can I use witr in CI/CD pipelines?

Absolutely. Use the --json flag to get structured output that you can parse with jq or any JSON tool. This makes witr ideal for automated debugging, deployment verification scripts, and monitoring integrations.

Does witr require root/sudo access?

witr works without root for processes owned by the current user. For system-wide visibility (other users' processes, kernel-level details), running with sudo provides more complete results.

How is witr different from htop or btop?

Tools like htop and btop show you what is running and its resource usage in real time. witr answers why it's running — the causality chain from systemd service to supervisor to the actual process. They complement each other: use htop for monitoring, witr for investigation.

Which container runtimes does witr support?

witr supports Docker, Podman, nerdctl, Kubernetes (via crictl), Incus, LXC, LXD, and FreeBSD jails — all in a single unified view.

Does witr collect any telemetry or data?

No. witr is a fully offline tool. It does not send any data anywhere. It only reads local system state to answer your queries.

Ready to level up your developer toolkit? Explore more courses and resources at CoddyKit — from CLI mastery to DevOps best practices.