Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
Best AI Agent Tools for DevOps on Linux in 2026: What Each One Actually Enforces
Eight tools for running AI agents on infrastructure you own, compared on what each one enforces rather than on features: Landlock, bubblewrap, Anthropic's sandbox-runtime, gVisor, containers, auditd, agent-lock and yeet. Which ones confine, which ones only record, which need root, and what each vendor's own documentation says it does not cover.
How to Let an AI Agent Fix Something in Production Safely (2026)
A fix and an incident are the same syscalls, so the question is not whether the agent is trustworthy but what it can reach, what you can undo, and what you can prove afterward. What Replit's own documentation changed after an agent deleted a production database during a code freeze, why an instruction is not a control, and how to keep a record of an agent's changes that the agent did not write.