Show HN: Witr – Explain why a process is running on your Linux system

Summary

witr (why-is-this-running) 1. Purpose witr exists to answer a single question: Why is this running? When something is running on a system—whether it is a process, a service, or something bound to a port—there is always a cause. That cause is often indirect, non-obvious, or spread across multiple layers such as supervisors, containers, services, or shells. Existing tools ( ps , top , lsof , ss , systemctl , docker ps ) expose state and metadata. They show what is running, but leave the user to infer why by manually correlating outputs across tools. witr makes that causality explicit. It explains where a running thing came from, how it was started, and what chain of systems is responsible for it existing right now, in a single, human-readable output. 2. Goals Primary goals Explain why a process exists , not just that it exists , not just that it exists Reduce time‑to‑understanding during debugging and outages Work with zero configuration Be safe, read‑only, and non‑destructive Prefer clarity over completeness Not a monitoring tool Not a performance profiler Not a replacement for systemd/docker tooling Not a remediation or auto‑fix tool 3. Core Concept witr treats everything as a process question. Ports, services, containers, and commands all eventually map to PIDs. Once a PID is identified, witr builds a causal chain explaining why that PID exists. At its core, witr answers: What is running? How did it start? What is keeping it running? What context does it belong to? 4. Supported Targets witr supports multiple entry points that converge to PID analysis. 4.1 Name (process or service) witr node witr nginx A single positional argument (without flags) is treated as a process or service name. If multiple matches are found, witr will prompt for disambiguation by PID. 4.2 PID witr --pid 14233 Explains why a specific process exists. 4.3 Port witr --port 5000 Explains the process(es) listening on a port. 5. Output Behavior 5.1 Output principles Single screen by default (best ...