Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF44linux44yeet41AI agents17observability14claude-code7networking6security6production4tracing4bcc3exectop3HTTP3incident-response3kubernetes3omarchy3sandboxing3supply chain3tcpdump3troubleshooting3uprobes3audit2auditd2bpftrace2BSON2capabilities2ci2containers2debugging2execsnoop2hyprland2MongoDB2oom2permissions2processes2quickshell2runtime-debugging2ssh2802.111agent-security1ai-sre1API debugging1bar-widget1benchmarks1biolatency1bpf-verifier1bubblewrap1build-performance1cgroups1Cilium1CO-RE1codex1confidential-computing1context-switches1cpu-accounting1cryptojacking1devops1egress1exfiltration1hardening1integration-testing1kprobes1kworker1landlock1local-llm1make1MCP1memory1n-plus-one1nodejs1npm1off-cpu1ollama1opentelemetry1packet-capture1plugin1postinstall1prepared statements1privilege1proc-filesystem1process-attribution1process-masquerading1proctop1profiling1query-shapes1Redis1refusal1RESP1rf1root-cause-analysis1runqlat1schedstat1seccomp1slowlog1SQLite1stratum1sudo1syscall1systemd1TCP1tcp-retransmits1terminal-bench1threat-modeling1TLS1tunnels1websocket1wifi1wireguard1wireless1wss1yeetkit1+111 more

All eBPF44 linux44 yeet41 AI agents17 observability14 claude-code7 networking6 security6 production4 tracing4 bcc3 exectop3 HTTP3 incident-response3 kubernetes3 omarchy3 sandboxing3 supply chain3 tcpdump3 troubleshooting3 uprobes3 audit2 auditd2 bpftrace2 BSON2 capabilities2 ci2 containers2 debugging2 execsnoop2 hyprland2 MongoDB2 oom2 permissions2 processes2 quickshell2 runtime-debugging2 ssh2 802.111 agent-security1 ai-sre1 API debugging1 bar-widget1 benchmarks1 biolatency1 bpf-verifier1 bubblewrap1 build-performance1 cgroups1 Cilium1 CO-RE1 codex1 confidential-computing1 context-switches1 cpu-accounting1 cryptojacking1 devops1 egress1 exfiltration1 hardening1 integration-testing1 kprobes1 kworker1 landlock1 local-llm1 make1 MCP1 memory1 n-plus-one1 nodejs1 npm1 off-cpu1 ollama1 opentelemetry1 packet-capture1 plugin1 postinstall1 prepared statements1 privilege1 proc-filesystem1 process-attribution1 process-masquerading1 proctop1 profiling1 query-shapes1 Redis1 refusal1 RESP1 rf1 root-cause-analysis1 runqlat1 schedstat1 seccomp1 slowlog1 SQLite1 stratum1 sudo1 syscall1 systemd1 TCP1 tcp-retransmits1 terminal-bench1 threat-modeling1 TLS1 tunnels1 websocket1 wifi1 wireguard1 wireless1 wss1 yeetkit1

September 25, 2026

How to Debug Runtime Errors in Production (2026): When the Stack Trace Isn't Enough

A stack trace tells you where your code was when it crashed, not what the machine was doing to it. The runtime errors that hurt most in production, an OOM kill, a SIGKILL, ENOSPC, EACCES, often leave no application trace at all because the kernel ended the process. Here is how to debug the runtime errors a breakpoint cannot reach.

runtime-debuggingproductionOOMeBPFdebugginglinuxyeet

August 24, 2026

Why Is My Container Using More Memory Than the Process Inside It? (2026)

Your app reports 400MB of heap, the cgroup says 1.2GB, and the OOM killer believes the cgroup. Page cache, socket buffers, page tables and slab are all charged to your container and none of them appear in RSS. How to read memory.stat, tell reclaimable from pinned, and find the bytes nothing attributes.

cgroupsmemoryoomkubernetescontainerseBPFlinuxyeet