---
title: Kernel-Assisted Observation
---
# Kernel-Assisted Observation
sysg observes service lifecycle with **pidfd** on Linux: at spawn it opens a
`pidfd` for the service, and the monitor `poll()`s those descriptors, so a
process exit wakes supervision **instantly** rather than at the next poll
tick. `waitpid` remains authoritative for reaping; the pidfd only supplies
readiness. This needs Linux 5.3+, no elevated capabilities, no kernel BTF, and
adds no dependencies to the supervisor.
## Why pidfd and not eBPF
sysg does not ship eBPF process-event observation. It buys nothing over pidfd
here:
- **Exit detection is already instant.** pidfd wakes the monitor the moment a
managed service exits; the `sched_process_exit` tracepoint adds nothing.
- **Descendants are already tracked.** Service process trees are owned via
their private session (SID), the generational provenance ledger, and — when
sysg is PID 1 — the wait broker. eBPF's fork/exec lineage is redundant for
the processes sysg manages.
- **The one residual gap is not reliably closable by eBPF.** A service that
`fork()`s, calls `setsid()`, and re-parents into a new session leaves sysg's
tree. Tracepoint events are advisory and lossy: after a dropped fork event,
`/proc` cannot reconstruct ownership. cgroup v2 is the authoritative
boundary for containing escaped descendants, not tracepoint lineage.
- **The cost is real.** eBPF adds the Aya dependency tree to the root
supervisor's trust base, requires `CAP_BPF`/`CAP_PERFMON` and kernel BTF at
`/sys/kernel/btf/vmlinux`, and fails to load on minimal musl-static
containers — a larger root attack surface for a narrow, unreliable gain.
## Known limitation
sysg supervises the process it spawns and the private session that process
retains. A service that deliberately escapes into a **new session**
(double-fork + `setsid`) and outlives its launcher is not tracked. Run
services in the foreground and let sysg own the process rather than
self-daemonizing.