Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Find Which Process Is Querying MongoDB on Linux in 2026: The Server Only Knows What the Client Told It
MongoDB's record of who connected is a handshake document the client wrote itself, carrying an address that any Docker NAT or Kubernetes node already rewrote. Covers appName, client metadata, currentOp, ss and lsof for socket ownership, and reading the sending pid off the socket with mongosnoop and yeet.
How to Sandbox and Monitor an AI Agent on Linux in 2026: Why a Proxy Can't Tell You Which Process Spoke
Five questions about an AI coding agent's egress that a MITM proxy, a container and an HTTPS_PROXY variable structurally cannot answer, ranked by how much of the answer survives the agent doing something you did not anticipate. Compared against AgentSight, Claude Code's built-in proxy, Dev Proxy, Landlock and microVMs, with the kernel hook that answers each and what it costs to run.
SQLite Has No Query Log. That's a Library Problem, Not a Logging Problem (2026)
SQLite has no server, so there is no daemon holding a log you could tail. The ecosystem answered that with sqlite3_trace_v2 and ORM echo flags, which are per-connection and need the app's cooperation. The shared libsqlite3 is a better place to stand, and here is what it costs you.
How to Test and Debug WebSocket Traffic on Linux in 2026: Your Integration Test Asserts on the Client, Not the Wire
A WebSocket integration test asserts on what your client library returned, which is not what crossed the connection. How to see the real frames inside wss:// on Linux with wssnoop, Wireshark and a TLS keylog, mitmproxy and Chrome DevTools, and how to turn a captured session into a fixture your test suite can replay.