Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to See What Untrusted Customer Code Does in Your Sandboxes: Watch It From a Kernel You Control
Code you didn't write can't be instrumented and its own logs are its own account, so untrusted code execution observability per tenant has to come from below it: eBPF in a Firecracker guest kernel, one host daemon keyed by cgroup for containers, and a weak fit under gVisor, with ciprof as the CI case.
Can an AI Agent Debug a Linux Server Without a Human? (2026)
Partly. An agent can gather evidence autonomously because reading a host is safe and reversible, and should not act autonomously because a restart is not. The real blocker is access: the data needed usually does not exist until someone collects it.
Why Are My Docker Logs Empty? (And How to Tail and Follow Them) (2026)
docker logs only captures the main process's stdout and stderr, so an app writing to a file inside the container shows nothing and a buffered process looks identical. Why the log is empty, what to use when it is, and why docker logs --tail 100 -f is the command once the logs exist.
How to Find Which Process Is Querying MongoDB on Linux in 2026: The Server Only Knows What the Client Told It
MongoDB's record of who connected is a handshake document the client wrote itself, carrying an address that any Docker NAT or Kubernetes node already rewrote. Covers appName, client metadata, currentOp, ss and lsof for socket ownership, and reading the sending pid off the socket with mongosnoop and yeet.
Why Is My Container Using More Memory Than the Process Inside It? (2026)
Your app reports 400MB of heap, the cgroup says 1.2GB, and the OOM killer believes the cgroup. Page cache, socket buffers, page tables and slab are all charged to your container and none of them appear in RSS. How to read memory.stat, tell reclaimable from pinned, and find the bytes nothing attributes.