Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to See What Untrusted Customer Code Does in Your Sandboxes: Watch It From a Kernel You Control
Code you didn't write can't be instrumented and its own logs are its own account, so untrusted code execution observability per tenant has to come from below it: eBPF in a Firecracker guest kernel, one host daemon keyed by cgroup for containers, and a weak fit under gVisor, with ciprof as the CI case.
Why Is My Build Slow? How to See What It Is Running Thousands of Times (2026)
A slow build is usually not one slow step. It is a cheap command running per file when it should run once, or a step running twice. Fold every process launch into one row per kind of command to see the counts, and read the fork-to-exec median to separate a slow program from a slow launch.
How to See Every Command Your Build Runs in CI on Linux: Capturing Them Is the Easy Part
Every exec a build starts is already visible to the kernel through the sched_process_exec tracepoint, so the hard part is volume and scope: execsnoop, strace -f, auditd, set -x and exectop compared on what each one can scope to one process tree and what each does with 7,745 lines of output.