What Just Ran on My Server?
A short-lived process changes the system, then disappears before snapshot-based monitoring sees it.
HOOK
Open investigation →syscalls/sys_enter_execve Three hosted investigations · Ubuntu x86_64
Stop guessing.
Ask the kernel.
Seven incident-first labs for engineers who operate Linux. Reproduce one bounded failure, collect one useful signal, and learn exactly where the evidence ends.
Current boundaryLabs 01, 02, and 07 are browser-accessible. Four more run through the documented local VM.
01Predict
02Observe
03Explain
04Bound
05Transfer
THE INCIDENT QUEUE
Seven failures worth understanding
Every lab starts with an operational question. Hosted badges describe what runs here today.
Who Touched This File—and Did It Fail?
A service repeatedly looks for configuration, but ordinary logs omit the pathname or return code.
HOOK
Open investigation →sys_enter_openat + sys_exit_openatWhy Can’t This Service Connect?
A client cannot connect, but the failure disappears inside generic application telemetry.
HOOK
Read local lab ↗sys_enter_connect + sys_exit_connectIs DNS Actually the Slow Part?
A request is slow and DNS is suspected without a measured resolver boundary.
HOOK
Read local lab ↗resolve_backend uprobeWhy Does the Network Keep Retrying?
Latency coincides with packet loss, but averages hide the affected flows.
HOOK
Read local lab ↗tcp/tcp_retransmit_skbWhy Is PID 1 Not PID 1?
Container and host process identifiers appear to contradict each other.
HOOK
Read local lab ↗sys_enter_execve + /proc enrichmentReading Verifier Errors and Surviving Kernel Drift
A program that looks correct fails before attachment at the kernel verifier boundary.
HOOK
Open investigation →syscalls/sys_enter_write + CO-RETHE METHOD
Evidence before explanation
01
Reproduce a bounded symptom
Each fixture creates a controlled failure. It is a teaching environment, never a production claim.
02
Capture the smallest useful signal
The observer attaches to a named kernel boundary and emits typed, time-bounded events.
03
State what remains unknown
A learner completes the incident only after naming what the evidence cannot establish.
PUBLIC ROADMAP
Expand only after proof
NOW
Three hosted labs
Execution, file access, and verifier portability with fixed operations.
NEXT
Kernel matrix
ARM64 and additional distribution kernels with observed compatibility receipts.
FELLOWSHIP
Community fixtures
Operator workshops, translations, and reviewed contributor incidents.