Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
Why Is My Build Slow? How to See What It Is Running Thousands of Times (2026)
A slow build is usually not one slow step. It is a cheap command running per file when it should run once, or a step running twice. Fold every process launch into one row per kind of command to see the counts, and read the fork-to-exec median to separate a slow program from a slow launch.
What Does npm install Actually Run on My Machine in 2026? Watching Postinstall Scripts as They Execute
A dependency's preinstall, install and postinstall scripts run as your user during npm install, and package.json shows what an author wrote rather than what executed. Watch a real install, read the flagged commands, and understand the boundary: a package that never launches a process leaves no trace at all.
How to See Every Command Your Build Runs in CI on Linux: Capturing Them Is the Easy Part
Every exec a build starts is already visible to the kernel through the sched_process_exec tracepoint, so the hard part is volume and scope: execsnoop, strace -f, auditd, set -x and exectop compared on what each one can scope to one process tree and what each does with 7,745 lines of output.