Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF11linux10yeet7observability6kubernetes3networking3tcpdump3AI agents2HTTP2802.111ai-sre1audit1cgroups1Cilium1claude-code1containers1integration-testing1memory1oom1opentelemetry1packet-capture1Redis1RESP1rf1root-cause-analysis1security1slowlog1tunnels1uprobes1websocket1wifi1wireguard1wireless1wss1

Why Is My Container Using More Memory Than the Process Inside It? (2026)

Your app reports 400MB of heap, the cgroup says 1.2GB, and the OOM killer believes the cgroup. Page cache, socket buffers, page tables and slab are all charged to your container and none of them appear in RSS. How to read memory.stat, tell reclaimable from pinned, and find the bytes nothing attributes.

cgroupsmemoryoomkubernetescontainerseBPFlinuxyeet
Read more →