Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
AlleBPF22linux21yeet18observability11AI agents5security5networking4uprobes4kubernetes3tcpdump3audit2BSON2containers2HTTP2MongoDB2process-attribution2tracing2802.111ai-sre1bcc1biolatency1bpf-verifier1bpftrace1cgroups1Cilium1claude-code1CO-RE1context-switches1cpu-accounting1cryptojacking1egress1exfiltration1incident-response1integration-testing1kprobes1kworker1MCP1memory1n-plus-one1off-cpu1oom1opentelemetry1packet-capture1prepared statements1proc-filesystem1process-masquerading1profiling1query-shapes1Redis1RESP1rf1root-cause-analysis1runqlat1schedstat1slowlog1SQLite1stratum1supply chain1tcp-retransmits1tunnels1websocket1wifi1wireguard1wireless1wss1
How to Find Which Process Is Querying MongoDB on Linux in 2026: The Server Only Knows What the Client Told It
MongoDB's record of who connected is a handshake document the client wrote itself, carrying an address that any Docker NAT or Kubernetes node already rewrote. Covers appName, client metadata, currentOp, ss and lsof for socket ownership, and reading the sending pid off the socket with mongosnoop and yeet.
MongoDBeBPFlinuxprocess-attributioncontainersuprobesobservabilityyeet
Read more →Why Is My Container Using More Memory Than the Process Inside It? (2026)
Your app reports 400MB of heap, the cgroup says 1.2GB, and the OOM killer believes the cgroup. Page cache, socket buffers, page tables and slab are all charged to your container and none of them appear in RSS. How to read memory.stat, tell reclaimable from pinned, and find the bytes nothing attributes.
cgroupsmemoryoomkubernetescontainerseBPFlinuxyeet
Read more →