How Transparent Huge Pages Work: Collapse, Split, and Why the Kernel Tries to Hide 2 MiB Pages
A process that allocates a multi-gigabyte heap does not have to map every 4 KiB page through its own page-table entry. On x86-64 the hardwar...
2026
How OverlayFS Works: Layers, Whiteouts, and Why Containers Share Base Images
A container that starts from a shared Debian image layer, writes a new hostname into /etc/hostname, and deletes a file that came from the ba...
Sarthak Bystander
3 Nov, 2026
How KVM Works: VM Exits, EPT, and Why a Guest Is Scheduled Like a Process
A process that starts a virtual machine does not execute guest instructions the way it executes its own. When the guest is running, the CPU ...
Sarthak Bystander
3 Nov, 2026
How KVM Works: VM Exits, EPT, and Why a Guest Is Scheduled Like a Process
A process that starts a virtual machine does not execute guest instructions the way it executes its own. When the guest is running, the CPU ...
Sarthak Bystander
3 Nov, 2026
How KVM Works: VM Exits, EPT, and Why a Guest Is Scheduled Like a Process
A process that starts a virtual machine does not execute guest instructions the way it executes its own. When the guest is running, the CPU ...
Sarthak Bystander
3 Nov, 2026
How Linux Capabilities and the LSM Framework Work: Fine-Grained Privilege, Hook Points, and Why Root Is No Longer All-or-Nothing
A process that needs to bind a low-numbered TCP port, or to change the system clock, does not need the power to rewrite arbitrary files, kil...
Sarthak Bystander
2 Nov, 2026
How Meltdown Works: Speculative Loads, Cache Side Channels, and Why KPTI Isolates Kernel Page Tables
A process that runs with ordinary user privileges is not supposed to read the kernel's page tables, credential structures, or another pr...
Sarthak Bystander
30 Oct, 2026
How the Linux Page Reclaim and OOM Killer Work: LRU Lists, Watermarks, and Why the System Kills Processes
A process that calls malloc for a multi-gigabyte buffer under memory pressure does not always receive the pages. The kernel may already be s...
Sarthak Bystander
27 Oct, 2026
How the Linux Network Transmit Path Works: sk_buffs, qdiscs, and Why send() Returns Before the Packet Leaves
A process that calls send() on a TCP socket expects the bytes to leave the machine eventually. It does not expect the call to wait until the...
Sarthak Bystander
24 Oct, 2026
How the Linux Network Transmit Path Works: sk_buffs, qdiscs, and Why send() Returns Before the Packet Leaves
Draft placeholder for the full transmit path article. Full content will be updated.
Sarthak Bystander
24 Oct, 2026
How TLB Shootdowns Work: IPIs, PCIDs, and Why Unmapping a Page Is Not Free
A process that calls munmap on a range it no longer needs expects the virtual addresses to disappear. On a single-core machine that is almo...
Sarthak Bystander
24 Oct, 2026
How the Linux Network Transmit Path Works: sk_buffs, qdiscs, and Why send() Returns Before the Packet Leaves
A process that calls send() on a TCP socket expects the bytes to leave the machine eventually. It does not expect the call to wait until the...
Sarthak Bystander
23 Oct, 2026
How File System Journaling Works: Ext4, Ordered Mode, and Why fsync Is Not Free
A database that calls fsync after a commit expects the bytes it wrote to survive a power cut. A filesystem that just renamed a temporary fil...
Sarthak Bystander
22 Oct, 2026
How the Linux Block Layer Works: bios, Request Queues, and Why I/O Is Batched
A filesystem that wants to write a dirty page does not issue a single system call that waits for the disk. It builds a bio , submits it, and...
Sarthak Bystander
20 Oct, 2026
How NUMA Works: Nodes, Distance, and Why First-Touch Allocation Matters
A process that calls malloc for a multi-gigabyte buffer on a two-socket server does not receive equal-cost memory. The physical frames behin...
Sarthak Bystander
18 Oct, 2026
How the Linux Network Receive Path Works: NAPI Polling, sk_buffs, Softirqs, and Why the Hard IRQ Never Copies the Payload
A NIC that has just finished DMA-ing a frame into a host ring buffer does not copy the payload in its hard interrupt handler. The handler do...
Sarthak Bystander
16 Oct, 2026
How Spectre Works: Speculative Execution, Branch Predictors, and Cache Side Channels
A bounds check that returns early is not a security boundary when the processor has already executed the instructions that follow it. Spectr...
Sarthak Bystander
14 Oct, 2026