Debug a flaky script end-to-end: record, inspect the timeline, and rewind to the exact moment it broke.
- Docker: The recommended build method uses Docker to provide a consistent environment with all dependencies included.
- Runtime Privileges (Linux): The core recording feature requires
sudoprivileges to attach the eBPF probes to the kernel. - Platform Support: The high-performance eBPF monitoring is Linux-specific. The tool provides a fallback for macOS and Windows with different performance characteristics.
The recommended way to build DiffKeeper is with Docker, which avoids needing to install any local dependencies.
# Build the 'diffkeeper' binary into the ./bin directory
make build-dockerizedThe final binary will be located at bin/diffkeeper.
Alternative: Local Builds If you prefer to build locally, you will need Go 1.23+,
clang, andbpftool. You can then runmake build.
CI users can skip this and reference uses: saworbit/diffkeeper@v1 in a workflow.
The repo ships with a tiny flaky test that silently corrupts status.log after 2 seconds.
./diffkeeper record --state-dir=./trace -- go run ./demo/flaky-ci-testThe process exits with a failure after a few seconds (expected).
./diffkeeper timeline --state-dir=./trace
[00m:00s] WRITE status.log (13B)
[00m:01s] WRITE db.lock (6B)
[00m:02s] WRITE status.log (22B) <-- corruption pointNow you know the precise timestamp to rewind to.
./diffkeeper export --state-dir=./trace --out=./restored --time="2s"
cat ./restored/status.log
# Output: ERROR: Connection LostYou have successfully captured the filesystem history, located the offending write, and restored the exact failing state.