Namespaces

Sandboxing an AI Coding Agent with Bubblewrap. What the Kernel Actually Enforces

I sandboxed a coding agent with bubblewrap and traced every command with bpftrace. Mounts decided writes. Secrets and the network still got through. Here's why.

19 Minutes Oct 29, 2026 3889 Words

Isolation in Containers. Linux Primitives that help Achieve It

Docker and Podman configure isolation. The Linux kernel enforces it. A deep dive into namespaces, cgroups, and seccomp. The three primitives that actually hold the boundary.

18 Minutes Apr 11, 2026 3654 Words

Billing and Metering in AI APIs

A deep dive into how billing and metering work in AI APIs, covering token counting, rate limits, and cost attribution strategies

9 Minutes Apr 5, 2026 1908 Words

What Is a Container? The OS-Level Truth Most Engineers Don't Know

Containers are not mini Linux machines. They are processes with namespace isolation and cgroup-enforced resource limits. Here is the kernel-level proof.

8 Minutes Apr 3, 2026 1547 Words

Scaling ID generation with Redis

Learn how to build a high-throughput, distributed ID generator using Redis. Explore atomic increments and Lua scripting to ensure unique, collision-free identifiers at scale while maintaining sub-millisecond latency.

13 Minutes Mar 22, 2026 2758 Words