Contrail replaces the round trip through the AWS console when you want to know what a service is doing: switch AWS
SSO profiles, browse clusters and services, and follow their logs live as readable, searchable lines. It is built
with Rust, Tauri 2 and React. There is no account, no server and no telemetry, it changes nothing in AWS unless you allow it (stopping tasks, updating a service), and
it keeps no credentials of its own.
Features
- Profiles and SSO. All profiles from
~/.aws/config with their login state; Log in runs
aws sso login for you, or logs in itself when the AWS CLI isn't installed (the token goes to the CLI's cache,
so both share it). Switch with Cmd/Ctrl+Shift+P, jump to any service with Cmd/Ctrl+K.
- Everything about a service on one page: running and recently stopped tasks with stop reasons and exit codes,
deployments, the task definition, recent events and environment variables (secret-looking values masked;
Secrets Manager and SSM values only on Reveal).
- Logs that read well. ECS JSON (nested or dotted), Spring Boot's console pattern and plain text are parsed;
stack traces split into one event per line are joined again. 100,000 lines scroll smoothly; parsing, buffering
and search run in Rust. A timeline above the list shows events over time by level; click or drag across it to focus the list on a part of the window. Surrounding lines shows the lines of the same task
around a line the search found. Deployments, stopped tasks (with exit codes) and service events show between
the lines and on the timeline.
- Live tail with CloudWatch Live Tail (or polling without the permission), paused automatically while you
don't look, because it is billed per minute.
- Search as you type: words, phrases, fields, levels, comparisons and regular expressions, as a filter or
highlighted. Level chips and "Hide lines like this" remove the noise. The Fields panel counts the most common
values of every field in the matching events; a click on one narrows the search. ↑ / ↓ recall earlier
searches; saved searches (per service or for all) are a click or Cmd/Ctrl+K away. Search syntax
- Tracing across services: follow a correlation or trace ID through the services of a cluster, on a timeline.
- Share a view: a
contrail:// link opens the same service, time window and search in a teammate's Contrail;
or open the same logs in the CloudWatch console for those without it.
- Tabs per service (each keeps its place), time windows (relative or fixed), wrapped or cut-off lines, export as
.log or .jsonl, field mapping for other JSON layouts, dark and light themes, keyboard-first.
- Updates itself: a signed update check once a day (can be switched off), installed only when you say so.
Not supported (yet): EKS, Lambda and other non-ECS log groups, log drivers other than awslogs, long-range
historical search. See the FAQ.
Install
Installers are attached to GitHub Releases. Once installed,
Contrail updates itself:
| Platform | File |
|---|
| macOS (Apple silicon / Intel) | Contrail_<version>_aarch64.dmg / Contrail_<version>_x64.dmg |
| Windows | Contrail_<version>_x64-setup.exe (installs per user, no admin rights) |
| Linux | .AppImage, .deb or .rpm |
The builds aren't code-signed yet. On macOS, right-click the app → Open the first time. On Windows, SmartScreen
asks once: More info → Run anyway. On Linux, make the AppImage executable with chmod +x.
SSO logins use the AWS CLI v2 when
it's installed; without it, Contrail logs in itself (a code to confirm in the browser) and shares the token with the
CLI's cache.
Getting started
- Make sure your AWS profiles are in
~/.aws/config (%USERPROFILE%\.aws\config on Windows), e.g. with
aws configure sso.
- Start Contrail, pick a profile and click Log in if its session has expired.
- Choose a cluster and a service in the sidebar (or press Cmd/Ctrl+K) and open its Logs tab.
- Type into the search box:
timeout level>=WARN -healthcheck.
Teammates with narrower AWS roles need the read-only permissions in docs/iam-policy.json
(changes need its optional ContrailOptionalChanges statement).
The user guide explains everything in more detail.
Try it without AWS
CONTRAIL_DEMO=1 (or --demo; pnpm dev:demo in app/ from a clone) starts Contrail with invented profiles,
clusters and live logs and makes no AWS calls at all.
Documentation
The same documents are on the website, with search.
| Document | For |
|---|
| User guide | Profiles, services, logs, live tail, search, tracing, settings, shortcuts |
| Using Contrail in a team | AWS config, permissions, what it costs, logs that work well |
| Security & privacy | What is read, stored and sent, read-only towards AWS unless you allow changes, secrets, updates |
| FAQ | License, system requirements, limitations, stability, support |
| Search syntax | Words, fields, levels, comparisons, regular expressions |
| IAM policy | The read-only permissions Contrail needs, and the optional ones (including changes) |
| Development | Setup, running, tests, CI builds, the website |
| Rust notes | The Rust patterns used in the code, explained for Java developers |
| plan.md | The specification and milestones |
| Decisions | Deviations from the plan and why |
Development
You need Rust (stable), Node.js 24, pnpm 12 and your platform's
Tauri prerequisites. Then:
cd app && pnpm install
pnpm dev # the app, with hot reload for the UI
Checks that CI runs (and every change must pass):
cargo fmt --all -- --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
cd app && pnpm lint && pnpm typecheck && pnpm test && pnpm test:e2e
pnpm build in app/ builds installers for your OS into target/release/bundle/. See
development.md for everything else.
Your data
Contrail reads your AWS config and the expiry of your SSO token cache, and stores only its preferences (favorites,
recent services, settings; never credentials or log content) in prefs.json in its app data folder
(~/Library/Application Support/io.github.clon1998.contrail/ on macOS, %APPDATA%\io.github.clon1998.contrail\ on
Windows, ~/.local/share/io.github.clon1998.contrail/ on Linux). It only talks to the AWS APIs of the profile you
selected and, once a day, to GitHub for the update check (switch it off in Settings → About → Updates). Details:
Security & privacy.
License
MIT. Use it, fork it, roll it out in your company; no warranty.
