Sources and supervisors
The Source line names the primary system responsible for starting or supervising a process. Exactly one source is selected, because in practice one thing owns the restart behaviour, and that is the thing you need to know about.
What can be a source#
systemd unit (Linux)
The unit name, its description and its configuration file. Timer-triggered services also report their schedule, so you can tell a service that runs continuously from one that fires every five minutes.
launchd service (macOS)
The service label with its plist location, plus interval or calendar trigger details where they apply.
Windows service
Display name and registry key, read through the Service Control Manager. No PowerShell or WMI dependency.
rc.d script (FreeBSD)
The rc script and its header description.
Supervisor
pm2 and similar process managers. Where a supervisor is in the chain, it is usually the thing that will restart the process after you kill it.
Container
Docker, Podman, nerdctl, Kubernetes (kubepods or crictl), containerd, Colima, Incus, LXC, LXD, and FreeBSD jails. Compose project and service labels come along when present.
cron
A scheduled job. Useful when a process appears, disappears and returns on a cadence you have not identified yet.
SSH session
Including the remote IP and terminal, so you can tell whose session left it behind.
Interactive shell
With tmux or screen session names where they apply — the answer to why a process outlived the terminal you closed.
Snap or Flatpak sandbox (Linux)
Identifies processes running inside an application sandbox.
Ports that resolve through a runtime#
When a port is owned by PID 1 through systemd socket activation, or by a container runtime rather than a plain process, witr falls back to resolving the port through the container layer instead of reporting a useless systemd (pid 1).
That fallback works on all four supported platforms.
Context around the source#
Beyond the source itself, witr reports on a best-effort basis:
- Working directory
- Git repository name and branch
- Container name and image
- Whether the bind is public or private
A public bind on a process you thought was local-only is one of the warnings worth reading.