Alternatives
Products that do what xstack – Passive eBPF Linux stack profiling without tracepoints does
Here's the latest eBPF performance tool of mine - xstack. It's a minimal tool, just 165 lines of eBPF C and under 500 lines of userland C code (including all comments and boilerplate!). It uses the libbpf and (Rust) BlazeSym libraries though (which are a lot of code). The point (and difference) of this tool is that it can sample both the kernel and userspace stack traces of all threads in your system. Traditionally, the "bpf_get_stack()" helper can not read userspace stack traces of other tasks in Linux, but since Linux 5.18 we can combine sleepable eBPF task iterator programs with a new…
- 1XV
Hello, I just released the (eventually) final version of my xcapture eBPF performance tool that now uses modern eBPF (libbpf, BTF, CO-RE, passive sampling using task iterators, task-local storage, etc). The previous BCC-based v2 version got a good discussion here last year [1], but due to BCC being less flexible and now deprecated, I decided to pull the plug and start from scratch with the latest eBPF features available. I'm targeting Linux kernels 5.14 and up. So Ubuntu 20 with HWE kernel (5.15) already works, RHEL9 works, Oracle's RHEL8 clone OEL8 with Oracle's UEK7 kernel (5.15) also…
2025 · tanelpoder.com
- 2SP
2017 · github.com
- 3
- 4
- 5
X-ray vision for improving your software performance
2018
- 6
- 7LF
Hi HN, I just wanted to share what I have been working on for the past few months: A firmware analyzer for embedded Linux systems that helps uncovering security issues running entirely in the browser. This is a very early Alpha. It is going to be rough around the edges. But I think it provides quite a lot of value already. So please go ahead and drop a firmware (only .tar rootfs archives for now) and try to break it :)
Mar 2026 · xray.boldwark.com
- 8WF
2021 · prodfiler.com
- 9DI
I built an open-source malware detection daemon that monitors all running processes in real-time using ML + heuristics. No kernel modules or eBPF required. Key points: - Polls /proc for new processes (works on any Linux kernel 2.6+) - Random Forest model trained on EMBER 2018 dataset (2.3M samples) - Heuristic rules for crypto miners, ransomware, rootkits - ~20MB RAM, <1% CPU, sub-millisecond scan latency - Pure C, zero runtime dependencies - Model embedded directly in binary (50KB) Why I built this: Existing solutions either require modern kernels (eBPF) or are heavy/proprietary.…
Nov 2025 · github.com
- 10AU
Hey HN! We built a tool that uses eBPF to discover AI services and their data flows in Kubernetes clusters. Modern AI apps often follow this pattern: 1. Service receives request 2. Queries database (PostgreSQL/Redis/MongoDB) 3. Sends data to LLM API (OpenAI/Anthropic/Bedrock) 4. Consumes or returns the AI generated response Security teams often don't know: - Which services are making AI calls - What databases they're accessing first - Whether PII is being sent to third-party APIs - What libraries and packages are being used for AI Our eBPF based tool attaches to network…
Jan 2026 · aurva.io
- 11DT
2020 · github.com
- 12RA
Hi HN! I built RustNet, a Terminal UI based network monitor written in Rust that shows real-time connections with process identification and protocol detection. What may make it interesting: • Deep packet inspection for HTTP, HTTPS/TLS (with SNI), DNS, and QUIC protocol detection • Process identification using eBPF on Linux (experimental) and PKTAP on macOS which does also catch short-lived processes that polling procfs or lsof would miss • Multi-threaded packet processing with lock-free data structures for the UI • Cross-platform (Linux, macOS, Windows but process identification so far…
Sep 2025 · github.com
- 13ID
Frustrated by the complexity and resource drain of multi service monitoring stacks, I built Simon. I wanted a single, lightweight dashboard to replace the heavy stack and the constant need for an SSH client for routine tasks. The result is a resource efficient dashboard in a single Rust binary, just a couple of megabytes in size. Its support for various architectures on Linux also makes it ideal for embedded systems and lightweight SBCs. It integrates: Comprehensive Monitoring: Realtime and historical metrics for the host system and Docker containers (CPU, memory, disk usage, and network…
Nov 2025 · github.com
- 14XT
Jul 2026 · github.com
- 15SA
I’ve been working on shuck, a shell script linter written in Rust. ShellCheck is excellent project and set the bar for this space. However, it's very slow and take up a far amount of resources. shuck is conservatively 20x faster than shellcheck and uses a fraction of the resources. shuck currently supports sh, bash, dash, ksh, mksh, and zsh. shuck should mostly be a drop in replacement for shellcheck but it is not a port since shellcheck is GPL. It is s clean-room implementation with its own parser and analysis engine, so behavior may differ in some cases. shuck is tested against shellcheck…
Apr 2026 · github.com
- 16IE
Quick note on how it works and how I've done my batch embedding engine IgniteMS. The whole thing runs as one process using Rust, reading input, tokenizing, packing batches, keeping the queue full. TensorRT handles inference. Python is only as a wrapper. I built it this way because when you use more than couple of GPUs, the GPUs stop being the problem. CPU cannot feed them fast enough. One A100 can go through batches faster than Python can tokenize and feed, so the GPU just sits there idle waiting for work. Most of my time went into optimizing this. At 8 GPUs that was basically the entire…
Jun 2026 · github.com
- 17WL
Hi HN, I’ve been working on a Rust userspace radio stack for running WFB-style links from macOS using RTL8812AU USB adapters. Full disclosure: I'm a software engineer, but not really a hardware or embedded systems engineer, so Codex GPT 5.5 has done the lion-share of the work here along with a bit of help from Claude Opus 4.7 here and there. It's taken about 1.5 to 2 weeks to get from zero to this first release. macOS doesn't expose the monitor-mode / packet-injection path that WFB systems normally rely on. I really didn't like the idea of needing a separate linux box just to talk WFB…
May 2026 · github.com
- 18TR
Hi HN, Today I'm showcasing Trunchbull, a benchmarking platform designed for authoring benchmarks and running them against different models. We have direct support for benchmarks that use the harbor authoring system, custom tool authoring via the vercel ai sdk and configuration limits. We've also already imported terminalbench 2.0, as a sort of proof of concept that our harbor task orchestrator works, although you currently need a paid account as we are provisioning sandbox environments. I've made several popular benchmarks publicly available for testing. You dont need an account or your…
24d ago · trunchbull.dev
- 19SC
Jan 2026 · github.com
- 20AI
Hi HN, I'm Kyle, the creator of Clipper, a container registry with 7x faster builds via lazy pulls and cache mount exports. In the process of implementing cache mount exports I ended up with a FUSE mounted filesystem backed by a remote content defined store. I went looking for fun things to do with it and found that there's not really a good way to keep Rust incremental build state around on ephemeral runners, so here we are. Rust generally uses https://github.com/mozilla/sccache for caching, but sccache disables itself when incremental compilation is enabled…
Jul 2026 · github.com
- 21
- 22OL
Hello Hacker News, I often hear people saying "all build-systems suck", an opinion I have been sharing for years, and this is the motivation for this project. I finally got the opportunity to make it open-source, and here it is. In a few words, it is like make, except it can be comfortably used even in big projects using HPC (with millions of jobs, thousands of them running in parallel). The major differences are that: - dependencies are automatically tracked (no need to call gcc -M and the like, no need to be tailored to any specific tool, it just works) by spying disk activity - it is…
2025 · github.com
- 23HX
2020 · github.com
- 24
Ranked by how close each launch is in meaning, then by votes. Refine with a description →