Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF34linux33yeet30observability13AI agents12security7claude-code4networking4uprobes4exectop3kubernetes3sandboxing3supply chain3tcpdump3tracing3audit2auditd2bcc2BSON2ci2containers2execsnoop2HTTP2incident-response2MongoDB2process-attribution2processes2production2ssh2802.111agent-security1ai-sre1bar-widget1biolatency1bpf-verifier1bpftrace1bubblewrap1build-performance1capabilities1cgroups1Cilium1CO-RE1codex1confidential-computing1context-switches1cpu-accounting1cryptojacking1devops1egress1exfiltration1integration-testing1kprobes1kworker1landlock1local-llm1make1MCP1memory1n-plus-one1nodejs1npm1off-cpu1ollama1omarchy1oom1opentelemetry1packet-capture1permissions1postinstall1prepared statements1proc-filesystem1process-masquerading1proctop1profiling1query-shapes1quickshell1Redis1RESP1rf1root-cause-analysis1runqlat1schedstat1seccomp1slowlog1SQLite1stratum1sudo1tcp-retransmits1threat-modeling1tunnels1websocket1wifi1wireguard1wireless1wss1yeetkit1+96 more

All eBPF34 linux33 yeet30 observability13 AI agents12 security7 claude-code4 networking4 uprobes4 exectop3 kubernetes3 sandboxing3 supply chain3 tcpdump3 tracing3 audit2 auditd2 bcc2 BSON2 ci2 containers2 execsnoop2 HTTP2 incident-response2 MongoDB2 process-attribution2 processes2 production2 ssh2 802.111 agent-security1 ai-sre1 bar-widget1 biolatency1 bpf-verifier1 bpftrace1 bubblewrap1 build-performance1 capabilities1 cgroups1 Cilium1 CO-RE1 codex1 confidential-computing1 context-switches1 cpu-accounting1 cryptojacking1 devops1 egress1 exfiltration1 integration-testing1 kprobes1 kworker1 landlock1 local-llm1 make1 MCP1 memory1 n-plus-one1 nodejs1 npm1 off-cpu1 ollama1 omarchy1 oom1 opentelemetry1 packet-capture1 permissions1 postinstall1 prepared statements1 proc-filesystem1 process-masquerading1 proctop1 profiling1 query-shapes1 quickshell1 Redis1 RESP1 rf1 root-cause-analysis1 runqlat1 schedstat1 seccomp1 slowlog1 SQLite1 stratum1 sudo1 tcp-retransmits1 threat-modeling1 tunnels1 websocket1 wifi1 wireguard1 wireless1 wss1 yeetkit1

September 17, 2026

Best AI Agent Tools for DevOps on Linux in 2026: What Each One Actually Enforces

Eight tools for running AI agents on infrastructure you own, compared on what each one enforces rather than on features: Landlock, bubblewrap, Anthropic's sandbox-runtime, gVisor, containers, auditd, agent-lock and yeet. Which ones confine, which ones only record, which need root, and what each vendor's own documentation says it does not cover.

ai-agentsdevopssandboxinglandlockauditdeBPFlinuxyeet