Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Sandbox and Monitor an AI Agent on Linux in 2026: Why a Proxy Can't Tell You Which Process Spoke
Five questions about an AI coding agent's egress that a MITM proxy, a container and an HTTPS_PROXY variable structurally cannot answer, ranked by how much of the answer survives the agent doing something you did not anticipate. Compared against AgentSight, Claude Code's built-in proxy, Dev Proxy, Landlock and microVMs, with the kernel hook that answers each and what it costs to run.
How to Capture Packets on wg0 and Other Tunnel Interfaces on Linux: The Ethernet Header Is Not Missing, It Was Never There
Capturing on wg0, gre1 or tun0 hands you a bare IP packet, because a raw-IP tunnel device has no MAC header to give you; pktscope is a terminal packet analyzer whose TCX eBPF tap starts the snap at the MAC header on Ethernet-framed devices and at the network header on tunnels, so the decode and the hex offsets match the device you picked.
How to Monitor HTTP Traffic on Linux in 2026: Why the Kernel Sees What Your Access Log Doesn't
How to see the HTTP requests crossing a Linux host, including the ones your access log never records because they never reached a handler. Covers eBPF capture at the kernel's TC layer, tcpdump, Coroot, Pixie, Cilium Hubble, a proxy and OpenTelemetry, with the commands to run and the kernel version each one needs.
eBPF-Speed L7 Enforcement Without a CNI Migration
Cilium has the fastest datapath in Kubernetes networking, and its best modes are gated behind cluster-wide commitments — here is when that trade is worth making, and when enforcing at XDP without touching your CNI is the smaller move.