Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
Why Is My Container Using More Memory Than the Process Inside It? (2026)
Your app reports 400MB of heap, the cgroup says 1.2GB, and the OOM killer believes the cgroup. Page cache, socket buffers, page tables and slab are all charged to your container and none of them appear in RSS. How to read memory.stat, tell reclaimable from pinned, and find the bytes nothing attributes.
How to Monitor HTTP Traffic on Linux in 2026: What the Kernel Sees That Your Proxy Doesn't
A sidecar proxy sees the traffic you routed through it. The kernel's TC layer sees what actually crossed the wire, including loopback, without anything being rerouted. Compares OpenTelemetry, Envoy, tcpdump, Pixie, Cilium Hubble and httpwatch, and how to pick the one that answers your question.
eBPF-Speed L7 Enforcement Without a CNI Migration
Cilium has the fastest datapath in Kubernetes networking, and its best modes are gated behind cluster-wide commitments — here is when that trade is worth making, and when enforcing at XDP without touching your CNI is the smaller move.