// TODO: I’m martinuke0

Welcome to my corner of the internet. This website is a personal blog which I use as a platform to document my learning journey and showcase it for the world to see.

Diagram of gVisor Sentry intercepting syscalls between application and host kernel.

Inside gVisor: How User-Space Kernels Sandbox Containers at the Syscall Boundary

gVisor moves the Linux kernel into userspace to sandbox containers at the syscall boundary, trading raw throughput for a dramatically smaller attack surface.

Diagram of an eBPF program attached to kernel hooks feeding a userspace collector on an embedded board.

Designing eBPF-Based Telemetry Pipelines for Constrained Embedded Linux Devices

How to design and ship eBPF-based telemetry pipelines on constrained embedded Linux devices — covering CO-RE, ring buffers, perf events, and the patterns that survive contact with 32 MB RAM and flaky flash.

Diagram of Karpenter consolidation evaluating nodes for replacement on a Kubernetes cluster.

Implementing Karpenter's Consolidation Disruption Policies for Spot Instance Workloads

How to design consolidation disruption policies in Karpenter that aggressively reclaim underutilized nodes without thrashing your Spot workloads, with real EKS configuration examples.

Diagram of the eBPF verifier, JIT, and hook points inside the Linux kernel.

Inside eBPF: How the Linux Kernel Runs Sandboxed Programs Inside Itself

TL;DR — eBPF lets you load and run sandboxed bytecode inside the Linux kernel at near-native speed, attached to hooks like network events, syscalls, and tracepoints. A static verifier guarantees the program terminates and stays safe before a JIT compiler turns it into machine code, which is why tools like Cilium, Pixie, and bpftrace have reshaped observability and networking in production. If you’ve shipped a service on Linux in the last five years, you’ve almost certainly been touched by eBPF — even if you never wrote a program yourself. Cilium powers the networking and service mesh layer for hyperscalers like AWS and Shopify. Datadog and New Relic ship kernel probes for zero-instrumentation tracing. Cloudflare uses eBPF to do connection tracking and DDoS mitigation at line rate. The reason this is possible is a piece of kernel machinery that turns “the kernel is a closed black box” into “the kernel is a programmable, observable, auditable system,” without compromising its stability. ...

Diagram of a Kubernetes cluster with traffic being progressively shifted from a stable to canary deployment.

Implementing Argo Rollouts: Progressive Delivery Strategies for Kubernetes Workloads

How to ship safer releases on Kubernetes with Argo Rollouts — covering blue-green, canary, traffic splitting, AnalysisTemplates, and the gotchas that bite in production.