Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to See What Untrusted Customer Code Does in Your Sandboxes: Watch It From a Kernel You Control
Code you didn't write can't be instrumented and its own logs are its own account, so untrusted code execution observability per tenant has to come from below it: eBPF in a Firecracker guest kernel, one host daemon keyed by cgroup for containers, and a weak fit under gVisor, with ciprof as the CI case.
How Do AI Agents Capture and Parse Linux Network Packets? (2026)
tcpdump captures fine and hands you a binary file an agent cannot reason about without a parser. How to decode in the capture path instead, so protocol, ports and fields like a TLS SNI arrive structured, and the limits: no reassembly, no pcap export, HTTPS payloads stay ciphertext.
Can an AI Agent Debug a Linux Server Without a Human? (2026)
Partly. An agent can gather evidence autonomously because reading a host is safe and reversible, and should not act autonomously because a restart is not. The real blocker is access: the data needed usually does not exist until someone collects it.
How Do I Control What an AI Agent Can Do on a Linux Server? (2026)
You cannot write policy for actions you cannot see, so the order is observe, decide, enforce. How to record what an agent actually runs and dials on Linux, why filesystem, process and network are three separate boundaries, and why a sandbox config does not bound the agent's own traffic.
Is My AI Agent an SSRF Risk? (And How to Fence Its Egress on Linux) (2026)
An agent makes outbound requests to destinations chosen at runtime by content it did not write, which is SSRF with a user manual. Deny link-local and 169.254.169.254 first, put policy around the agent process rather than its command sandbox, and measure the real destination set before writing an allowlist.
What Does My AI Agent Connect To? (Linux 2026)
An agent transcript records decisions, not connections, so MCP servers, package registries and subprocess traffic never appear in it. How to read outbound connections per process at the kernel, name TLS destinations by SNI, and why DNS taps see almost nothing on a glibc host.
Does the Codex Sandbox Block Network Access on Linux? (2026)
workspace-write ships with network_access = false, so sandboxed commands are put in a network namespace. What that never covered is Codex itself: model requests, MCP connections, web search and connector calls all originate outside the command sandbox. How to tell which side a connection came from.
How Do I Give Claude Code Access to My Database Queries on Linux? (2026)
There are three levels of database access you can give a coding agent, and they answer different questions. A read-only role explains query plans, pg_stat_statements ranks expensive statements, and a socket reader like sqlsnoop shows the statements your app actually sent, with bound values and the sending process, without a credential or a connection to the database.
Can an AI Agent Debug My Database Without Connecting to It? (Linux 2026)
An agent can read every statement your app sends Postgres or MySQL off the socket, with bound values and the sending process, without a role, a password or a connection. That covers N+1 patterns, query storms and unexpected senders. Query plans still need EXPLAIN. Where the line falls, and what the capture still exposes.
Why Is My AI Coding Agent Slow? Most of the Wait Never Leaves Your Machine (2026)
A slow agent turn is a stack: context gathering across thousands of file reads, subprocess spawns, language servers, MCP round-trips, TLS setup and inference. Only the last is the model. Here is how to measure where a turn actually goes on Linux in 2026, with claudefeed and exectop.
How to Let an AI Agent Troubleshoot Your Network on Linux in 2026: Give It the Wire, Not the Dashboard
Agentic NetOps products from NetBrain, Cisco and Selector reason over telemetry a device already exported, and a Wireshark MCP server needs a capture that was running when the failure hit. Here is what an agent has to be able to read to find a reset, a stale DNS answer or a failed handshake on a Linux host, and how yeet lets it read the wire from the kernel without a shell or root.
How Do I Get an AI Agent to Debug My API? (2026)
Your agent can read your code and your logs, which is why it keeps guessing. Give it the traffic instead: every request and response the machine actually sent, read from the kernel, and the agent follows the failure into the network rather than reasoning about what should have happened.
How Do I Detect API Drift After a Deploy? (2026)
A field disappears from a response, an id changes from a number to a string, and nothing errors. The provider is fine, your service is fine, and only the strictest client breaks. Here is how to catch API drift on Linux by learning each endpoint's shape from live traffic and reporting what changed.
How Do I Find an N+1 Query From API Traffic? (2026)
An N+1 does not fail, it just makes two hundred calls where one would do. Your ORM logs each query as a success and your APM shows a slow endpoint without saying why. Here is how to find N+1 queries and chatty API calls on Linux by counting what actually crossed the wire.
Top 7 Runtime Debugging Tools for Linux in 2026 (and the One Built for AI Agents)
Runtime debugging means inspecting a program while it runs in production, and the tools split on one line: whether they see inside one application you instrumented, or the whole running machine from the kernel. Seven runtime debugging tools ranked on that axis, including the only one you can hand to an AI agent to investigate a live host.
Claude Code on Omarchy in 2026: Setup, Permissions, and Linux Agent Workflows
Omarchy ships Claude Code as a pre-wired mise stub, so there is nothing to install and the real work is permissions. What the default launchers actually do, why the manual warns that agents run in don't-stop-to-ask modes, which permission mode to set for unattended work, and how to see what an agent did on a Hyprland box when its own transcript stops at the shell.
Why Claude Refused Your Syscall Hooking Request (2026): It's the Pattern, Not the Tool
Claude refuses a syscall hooking request when the pattern reads as covert interception of another party, not because syscall tracing is off limits. What actually triggers the refusal, why tracing your own process works while capturing another user's does not, and how supplying the authorization context turns the same task into a plan rather than fighting the model.
AI Agent Privilege on Linux in 2026: Users, Capabilities, and What Each One Buys
What a dedicated Linux user actually buys you for an AI agent, why capabilities are a good subtractive tool and a bad additive one, which systemd directives survive a JIT runtime, and where privilege reduction stops answering the question. Every directive quoted from systemd and capabilities(7) rather than recalled.
How Do I Sandbox Codex on Linux? (2026)
Codex enforces its Linux sandbox with bubblewrap plus seccomp, so it inherits bubblewrap's properties and its failure modes. What read-only, workspace-write and danger-full-access actually permit, why OpenAI rejected the legacy Landlock path, what the network proxy does not filter, and how to tell the sandbox is working rather than silently failing with exit code 0.
Best AI Agent Tools for DevOps on Linux in 2026: What Each One Actually Enforces
Eight tools for running AI agents on infrastructure you own, compared on what each one enforces rather than on features: Landlock, bubblewrap, Anthropic's sandbox-runtime, gVisor, containers, auditd, agent-lock and yeet. Which ones confine, which ones only record, which need root, and what each vendor's own documentation says it does not cover.
How Do I Let Claude Investigate Production on Linux? (2026)
Claude Code runs on your laptop and production is somewhere else, so investigating it means SSH, a bastion or an MCP server, and each has a different blast radius. Which permission mode fails closed, why a developer's settings.json is a preference and managed-settings.json is a control, what deny rules survive, and where Claude's own permission system stops mattering.
How to Let an AI Agent Fix Something in Production Safely (2026)
A fix and an incident are the same syscalls, so the question is not whether the agent is trustworthy but what it can reach, what you can undo, and what you can prove afterward. What Replit's own documentation changed after an agent deleted a production database during a code freeze, why an instruction is not a control, and how to keep a record of an agent's changes that the agent did not write.
How Do I Let an AI Agent Inspect a Linux Server Safely? (2026)
Four ways to give an AI agent access to a Linux server it does not own, compared on what each one actually grants: an SSH account, a read-only user with sudo rules, a container alongside the workload, and a daemon that answers queries without handing over a login. What breaks in each, and why the capabilities that make inspection useful are also the ones that let an agent write.
What AI Agents Get Wrong on Linux in 2026: The Benchmark Says They Fail at Checking, Not at Knowing
Frontier agents now score above 90% on Terminal-Bench, so the interesting question is what is left in the rest. The ICLR 2026 error analysis puts 35.1% of execution errors on command not found and 14.1% on verification failures, which are both failures of knowing the machine rather than knowing Linux. What that means for an agent running on your host, where there is no test suite to check against.
How to Run AI Agents Locally on Linux (2026)
Running an AI coding agent locally means the agent process is yours and the model usually is not. How to install Claude Code, Codex, Aider or an offline model on Linux, what the sandbox defaults allow, which parts of the loop still make network calls, and how to see what the agent ran on your box from the kernel, in four commands and no account.
AI Agents on Linux in 2026: Two Threat Models, and the One Your Stack Probably Isn't Solving
Confidential computing protects an agent from the infrastructure it runs on. Nothing in that stack protects your infrastructure from the agent. Two threat models with opposite trust assumptions get sold under one phrase, and the tell is which direction the isolation points. How to tell which problem you actually have, and what the kernel can record that an agent's own telemetry cannot.
Can an AI Coding Agent Exfiltrate My Source Code? What a Domain Allowlist Decides, and What It Doesn't (2026)
A domain allowlist decides whether a connection may open, not what goes through it, and the proxy in front of your agent does not read TLS by default. Here are the six ways to control agent egress on Linux in 2026, what each one covers, and how to see every host your agent dialed with claudefeed.
How to Audit a Local MCP Server on Linux: The Tool Call Is the Request, Not the Record (2026)
An MCP server on the stdio transport is a subprocess your agent launches, running as your user with your full filesystem and network access. Your agent's log records the tool call, not the syscalls the server ran. Here is how to audit one on Linux in 2026, with claudefeed and exectop.
How to Audit What an AI Coding Agent Actually Ran on Linux in 2026: The Log Stops Where the Shell Begins
Claude Code, Codex and Cursor all log their tool calls, and Anthropic documents the boundary in its own docs: OTEL_* is never passed to the subprocesses the Bash tool spawns. Compare what OpenTelemetry, an MCP gateway, auditd, strace and a kernel probe each record when an agent runs a shell one-liner, and see which one can name the commands underneath it.
How to Sandbox an AI Coding Agent on Linux in 2026: What the Kernel Can Refuse That Permissions Only Ask About
Claude Code, Codex, Aider and self-hosted agents run with your full filesystem access and choose what to read on their own — here are the six real ways to confine one, what each actually covers, and why the built-in sandboxes govern shell commands rather than the agent's own file reads.