How to design and ship eBPF-based telemetry pipelines on constrained embedded Linux devices — covering CO-RE, ring buffers, perf events, and the patterns that survive contact with 32 MB RAM and flaky flash.
TL;DR — eBPF lets you load and run sandboxed bytecode inside the Linux kernel at near-native speed, attached to hooks like network events, syscalls, and tracepoints. A static verifier guarantees the program terminates and stays safe before a JIT compiler turns it into machine code, which is why tools like Cilium, Pixie, and bpftrace have reshaped observability and networking in production. If you’ve shipped a service on Linux in the last five years, you’ve almost certainly been touched by eBPF — even if you never wrote a program yourself. Cilium powers the networking and service mesh layer for hyperscalers like AWS and Shopify. Datadog and New Relic ship kernel probes for zero-instrumentation tracing. Cloudflare uses eBPF to do connection tracking and DDoS mitigation at line rate. The reason this is possible is a piece of kernel machinery that turns “the kernel is a closed black box” into “the kernel is a programmable, observable, auditable system,” without compromising its stability. ...
Compare io_uring and epoll as Linux async I/O architectures, covering kernel internals, syscall costs, and the production patterns where each one wins.
How BBR actually estimates bottleneck bandwidth and RTT, why v2/v3 fix v1’s loss-insensitivity, and what to tune at the kernel, application, and NIC layers before you ship it.
Docker has revolutionized software development and deployment by providing lightweight, portable containers that package applications and their dependencies together. But how exactly does Docker work under the hood to achieve this isolation and efficiency? This article takes a comprehensive look at Docker’s internal architecture, explaining the key components and how they interact to create and run containers. Table of Contents Introduction Docker’s Client-Server Architecture Key Docker Components Docker CLI Docker Daemon (dockerd) Container Runtime (containerd and runc) Linux Kernel Features How Docker Creates and Runs a Container Filesystem Management with OverlayFS Networking and Isolation Resource Management via cgroups Conclusion Introduction Docker containers provide isolated environments that behave like virtual machines but share the host OS kernel, making them highly efficient. This is achieved through a combination of Linux kernel features, container runtimes, and Docker’s own architecture. Understanding these layers helps in optimizing container usage and troubleshooting complex issues. ...