Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF22linux21yeet18observability11AI agents5security5networking4uprobes4kubernetes3tcpdump3audit2BSON2containers2HTTP2MongoDB2process-attribution2tracing2802.111ai-sre1bcc1biolatency1bpf-verifier1bpftrace1cgroups1Cilium1claude-code1CO-RE1context-switches1cpu-accounting1cryptojacking1egress1exfiltration1incident-response1integration-testing1kprobes1kworker1MCP1memory1n-plus-one1off-cpu1oom1opentelemetry1packet-capture1prepared statements1proc-filesystem1process-masquerading1profiling1query-shapes1Redis1RESP1rf1root-cause-analysis1runqlat1schedstat1slowlog1SQLite1stratum1supply chain1tcp-retransmits1tunnels1websocket1wifi1wireguard1wireless1wss1+65 more

September 3, 2026

Can an AI Coding Agent Exfiltrate My Source Code? What a Domain Allowlist Decides, and What It Doesn't (2026)

A domain allowlist decides whether a connection may open, not what goes through it, and the proxy in front of your agent does not read TLS by default. Here are the six ways to control agent egress on Linux in 2026, what each one covers, and how to see every host your agent dialed with claudefeed.

AI agentsexfiltrationegresseBPFsecuritylinuxyeet