Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
AI Agent Privilege on Linux in 2026: Users, Capabilities, and What Each One Buys
What a dedicated Linux user actually buys you for an AI agent, why capabilities are a good subtractive tool and a bad additive one, which systemd directives survive a JIT runtime, and where privilege reduction stops answering the question. Every directive quoted from systemd and capabilities(7) rather than recalled.
How Do I Let an AI Agent Inspect a Linux Server Safely? (2026)
Four ways to give an AI agent access to a Linux server it does not own, compared on what each one actually grants: an SSH account, a read-only user with sudo rules, a container alongside the workload, and a daemon that answers queries without handing over a login. What breaks in each, and why the capabilities that make inspection useful are also the ones that let an agent write.