Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
What Does npm install Actually Run on My Machine in 2026? Watching Postinstall Scripts as They Execute
A dependency's preinstall, install and postinstall scripts run as your user during npm install, and package.json shows what an author wrote rather than what executed. Watch a real install, read the flagged commands, and understand the boundary: a package that never launches a process leaves no trace at all.
How to Audit a Local MCP Server on Linux: The Tool Call Is the Request, Not the Record (2026)
An MCP server on the stdio transport is a subprocess your agent launches, running as your user with your full filesystem and network access. Your agent's log records the tool call, not the syscalls the server ran. Here is how to audit one on Linux in 2026, with claudefeed and exectop.
How to See Every Command Your Build Runs in CI on Linux: Capturing Them Is the Easy Part
Every exec a build starts is already visible to the kernel through the sched_process_exec tracepoint, so the hard part is volume and scope: execsnoop, strace -f, auditd, set -x and exectop compared on what each one can scope to one process tree and what each does with 7,745 lines of output.