Blackbox Linux — build notes

Working notes from building Blackbox Linux: an eBPF runtime visibility agent for Linux servers, written in Rust. Process-tree tracing, in-kernel filtering, a small declarative rule engine.

Not released yet

First public release targets December 2026. Until there is a tagged version and a public repository, everything here describes intent and work-in-progress, not shipped behaviour. If you are evaluating it for production, wait for the tag.

This section is the engineering diary — the decisions, the measurements, and the things that turned out to be wrong. The product page has the overview and architecture; this is where the reasoning lives.

Why it is being built in the open

The claim Blackbox makes is that you should not run an agent you cannot audit as root on every host you own. That claim is only worth anything if the work itself is inspectable — including the parts that did not work. So the notes go up as they happen rather than being tidied into a launch post.

What gets written about here

• Kernel work — probe attachment, CO-RE, what verifier rejections actually meant, why a given hook was the wrong one.
• Filtering — the cost of an event that reaches userspace versus one dropped in-kernel, measured rather than assumed.
• Correlation — turning a flat stream of fork/execve/exit into process trees a human can read, and where that gets expensive.
• Overhead — honest numbers on real workloads, including the cases where the overhead was worse than expected.

Follow along

There is no mailing list. Posts land in the blog, and the repository goes public with the first release. If you have a use case that should shape it — particularly an environment where existing agents were too expensive or too opaque — email me and tell me about it while the design is still soft.