Open source · December 2026

Blackbox Linux

An open-source eBPF agent for Linux servers, written in Rust. It combines declarative rules with a learned baseline of how each server normally behaves, filters the noise in the kernel, and flags behaviour it has never seen before — without a proprietary binary running as root.

Blackbox Linux is not released yet. This page describes what the project aims to be, not what you can download today. First public release is targeted for December 2026.

Tell me when it is released My pledge

The problem

Runtime security on Linux is largely sold as closed agents licensed per host. You cannot read what they do, you cannot audit what they send, and the price scales with exactly the thing you were hoping to grow. The open alternatives exist but tend to assume you have a platform team to operate them. Meanwhile the kernel has had the right primitives for years.

The approach

Attach eBPF programs to the events that matter — process lifecycle, execution, and the syscalls that indicate something interesting — and do the filtering in the kernel before the data ever costs you anything. Group related events into process trees so a human can read them. On top of the rules, learn what each server normally does and score what it has never done, so an attack you did not write a rule for can still surface. Then ship them wherever you already send telemetry, in a format you did not have to buy a parser for.

What it does

Process-tree tracing

fork, execve and exit correlated into trees rather than a flat firehose of unrelated lines, so you can see what started what.

Early-drop filtering

Rules evaluated close to the kernel so uninteresting events are discarded before they become egress, storage, or an ingest bill.

Rule engine

Declarative predicates over event fields — equals, contains, prefix, suffix, and boolean combinations — kept deliberately small and fast.

Learned baselines

Each server’s normal process and execution patterns are learned over time. Anything it has never done before is scored and reported alongside rule matches.

Written in Rust

Userspace agent in Rust with the probes built on aya. Memory safety matters more than usual when the thing runs privileged on every host.

Ships where you already look

Structured events over a ring buffer, batched out to your existing pipeline instead of a vendor-specific endpoint.

Open source, not open core

One codebase, one feature set, permissively licensed. Every feature is in the open-source version; there is no paid tier.

The approach

Architecture

Seven stages, kernel outward. Each one exists to make the next one cheaper.

eBPF probes
Attached to process lifecycle and selected syscalls
In-kernel filters
Drop uninteresting events before they leave the kernel
Ring buffer
Lock-free hand-off from kernel to userspace
Classifier
Correlates raw events into process trees
Baseline scorer
Compares each process tree with what the server normally does
Rule engine
Declarative predicates decide what is worth reporting
Exporters
Batched structured output to your telemetry stack

Roadmap

Targeting a first public release in December 2026. It is being built in the open because that is the only way to make the audit claim credible — but until it is tagged, treat everything here as intent rather than documentation.

NowCore probes, filtering, process-tree correlation and baseline scoring in private testing
December 2026First public release: repository, licence, documented rule format and baseline model
AfterPackaging for common distributions, exporter integrations, hardening guides

Tell me when it is released

There is no mailing list and no signup form. Email me and I will tell you when the repository goes public — or if you have a use case that should shape it, tell me that instead.

Tell me what is broken

A short description is enough. Within one business day I will tell you what I think the problem is, roughly how long it takes, and whether you need me at all. Sometimes the honest answer is no.

[email protected]

I reply within 1 business day · No contact forms, no tracking pixels, no CRM sequence.

On GitHub