thenetworkfactory/tiny-tools repository overview

docker pull thenetworkfactory/tiny-tools

docker run --rm -it --network myproject_default \
    thenetworkfactory/tiny-tools bash

docker run --rm -it --network host thenetworkfactory/tiny-tools bash

docker compose exec tiny-tools bash

# Does the name resolve at all, and to what?
dig +short api.example.internal
host api.example.internal

# Which resolver is the container actually using?
cat /etc/resolv.conf

# Ask a specific resolver — is it the resolver that is broken, or the record?
dig @8.8.8.8 example.com
dig @127.0.0.11 api          # Docker's embedded DNS, inside a compose network

# Full chain, including CNAMEs and the authoritative answer
dig +trace example.com

# Is this a DNS problem or a connectivity problem? drill is terser than dig.
drill -V0 example.com

# Reverse lookup
dig -x 10.42.0.7

# Fastest yes/no on a single port
nc -zv api 8000

# Range, on one host
nmap -p 1-1000 api

# What is listening in THIS container / on this host (--network host)
ss -tulnp

# Which process holds a port open
lsof -i :8000

# Status, timings and the redirect chain, no body
curl -sS -o /dev/null -w 'code=%{http_code} time=%{time_total}s\n' https://example.com
curl -sSIL https://example.com

# Bypass DNS and hit a specific backend, keeping the Host header —
# the single most useful trick for debugging reverse-proxy routing
curl -sS -H 'Host: api.example.internal' http://<container-ip>:8000/

# Same, without needing the IP by hand
curl -sS --resolve api.example.internal:80:172.18.0.5 \
     http://api.example.internal/

# What security headers is the proxy actually adding?
curl -sSI https://example.com | grep -iE 'content-security|strict-transport|referrer|x-frame'

# Is the proxy serving the app, or a maintenance/error page?
curl -sS https://example.com | head -20

# Pretty-print a JSON API
curl -sS http://api.example.internal/health | jq .

# A reverse proxy's own admin API — which route matched?
# (Traefik shown; adjust the path for nginx/Caddy/HAProxy.)
curl -sS http://proxy-admin.example.internal:8080/api/http/routers | jq -r '.[].name'

# Full handshake, chain and expiry
openssl s_client -connect example.com:443 -servername example.com </dev/null

# Just the dates
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer

# Does it negotiate TLS 1.3?
openssl s_client -connect example.com:443 -tls1_3 </dev/null 2>&1 | grep -E 'Protocol|Cipher'

# Is the chain complete, or is an intermediate missing?
openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | grep -c 'BEGIN CERT'

ip -brief addr                 # what IPs does this container have
ip route                       # default gateway
ip neigh                       # ARP cache
traceroute api                 # where does it stop
mtr -rwc 20 8.8.8.8            # sustained path + loss (report mode)
ethtool eth0                   # link speed / duplex (--network host)

# Everything to/from a host, no name resolution (-n keeps it fast)
tcpdump -ni any host api

# Just the HTTP port, with payload
tcpdump -nAs0 -i any port 8000

# Write a pcap out to the host for Wireshark
tcpdump -ni any -w /tmp/cap.pcap port 5672

# Between two containers: server on one, client on the other
iperf3 -s                                   # on A
iperf3 -c A -t 10                           # on B

# Quick HTTP load check
ab -n 200 -c 10 https://example.com/

# Generate a bcrypt htpasswd entry (basic-auth middleware)
htpasswd -nbB admin 'somepassword'

sipcalc 10.42.0.0/22           # range, broadcast, usable addresses
sipcalc -s 26 10.42.0.0/22     # split into /26s

ps aux
top
free -m
vmstat 1 5

conntrack -L                   # live NAT + connection table
conntrack -E                   # follow events as they happen

# Postgres / MySQL / Redis clients are NOT installed (too large) — but
# you can still prove the port answers and speaks the right protocol:
nc -zv db 5432
(printf 'PING\r\n'; sleep 1) | nc redis 6379     # expect +PONG

# Forward a container-internal port to your shell for a one-off
socat TCP-LISTEN:15432,fork TCP:db:5432

rsync -av /data/ user@host:/backup/

# Ad-hoc
docker run --rm -it --cap-add NET_ADMIN --cap-add NET_RAW \
    --network myproject_default thenetworkfactory/tiny-tools bash

apk add --no-cache postgresql-client