Pick the part of the stack that's misbehaving.

Sandboxing & Privilege

21 articles · 9 syscalls

Process sandboxing on Linux and BSD from the syscall up: seccomp-BPF, Landlock, openat2, prctl, capabilities, OpenBSD pledge and unveil, FreeBSD jails.

1. 01Your process doesn't need 400 syscalls. seccomp-BPF lets you say so.
2. 02landlock: sandbox your process without root
3. 03openat2(2): path resolution you can actually trust

Namespaces & Containers

10 articles · 5 syscalls

What a container actually is: Linux namespaces, setns and unshare, nsenter, ip netns, cgroups v2, clone3, and FreeBSD jails on ZFS.

1. 01Your container is six clone(2) flags. nsenter gets you back in.
2. 02setns and unshare: moving between Linux namespaces
3. 03ip netns is what container networking actually is. No daemon required.

File Descriptors & IPC

18 articles · 16 syscalls

Everything is a file descriptor now: pidfd, memfd_create, SCM_RIGHTS fd passing, close_range, timerfd/signalfd/eventfd, splice, copy_file_range, statx.

1. 01pidfd: Unix finally has a handle on your processes (only took 50 years)
2. 02SCM_RIGHTS: send an open file descriptor to another process over a Unix socket
3. 03memfd_create and file sealing: an anonymous file nobody can modify (including you)

Linux Memory

16 articles · 8 syscalls

How Linux memory actually behaves: PSS vs RSS, MADV_FREE, madvise and process_madvise, mlock and memfd_secret for secrets, userfaultfd, and the OOM killer.

1. 01ps lies about memory. /proc/smaps_rollup does not.
2. 02MADV_FREE and the RSS number that's lying to you
3. 03process_madvise: memory pressure hints across process boundaries

Tracing & Performance

17 articles · 4 syscalls

Finding where the time goes from the console: strace -c, bpftrace latency histograms, dtrace, perf stat and record, ftrace, CPU pinning, I/O priority.

1. 01strace -c is a profiler. Stop spraying and praying.
2. 02Read a wedged process with your hands, not a dashboard
3. 03bpftrace gives Linux what FreeBSD had in 2005. The one-liners are worth the wait.

ZFS & Storage

24 articles · 4 syscalls

Practical ZFS, filesystems, backups, replication, and storage failure analysis for operators.

1. 01zfs send is the backup tool you already have and probably aren't using
2. 02Upgrade like you can undo it, because with bectl you can
3. 03No, ZFS did not eat your RAM. Read arc_summary before you tune anything.

Networking & DNS

33 articles · 2 syscalls

DNS, TLS, packet capture, routing, sockets, SSH, and network debugging from the console.

1. 01Stop guessing what's listening on that port
2. 02ss -i shows you what netstat never could: TCP internals live
3. 03dig +trace, and how to tell whose DNS is actually lying to you

Kernel & Security

45 articles · 4 syscalls

Kernel changes, operating-system security, vulnerabilities, hardening, and the tradeoffs behind them.

1. 01io_uring's attack surface and IORING_REGISTER_RESTRICTIONS
2. 02io_uring shipped in 2019 to eliminate syscall overhead. It also became the most reliably exploited surface in the kernel. Production fleets are disabling it.
3. 03The eBPF verifier is 30,000 lines of C, and it has the privilege-escalation CVEs to show for it

Reliability & Observability

28 articles · 2 syscalls

Production incidents, failure modes, observability, deployment safety, and resilient operations.

1. 01The health check was green because it was checking the wrong damn thing
2. 02We wrote the retry logic to survive a blip. It turned a blip into four hours.
3. 03The change was correct. Deploying it to every region simultaneously was not.

Unix Shell & Tooling

20 articles · 1 syscall

Shell techniques, Unix utilities, process inspection, automation, and tools worth remembering.

1. 01Your shell pipeline succeeded because the last command was polite
2. 02Your shell scripts crash. trap EXIT is why the mess does not have to survive.
3. 03find | xargs is a filename injection bug you've been shipping for years

FreeBSD & OpenBSD

16 articles · 3 syscalls

FreeBSD and OpenBSD for working operators: jails on ZFS, bectl boot environments, pf tables, dtrace, pledge and unveil, and releases that matter.

1. 01ZFS boot environments + jails will do 90% of what you're using Docker for, and the other 10% is the part you don't actually need
2. 02Upgrade like you can undo it, because with bectl you can
3. 03Let pf keep the ban list so you don't have to

Toolchains & Industry

27 articles

MOTD takes on compilers, language runtimes, open-source maintenance, vendor pricing and lock-in, and what AI tooling is doing to the trade.

1. 01Go count how many of your dependencies have one maintainer
2. 02Your build pipeline depends on a stranger's free tier and you found out on a Tuesday
3. 03If the AI does the junior work, where do senior engineers come from in 2036?