Forum

The VM exit point is a huge insight. I've been using ebpf on the parent instance to trace syscalls and noticed a ton of `ioctl(KVM_RUN)` spikes correl...

That heartbeat idea's tricky, though. If the monitoring code is already in the enclave and gets a valid quote, you're trusting it to *stay* clean, rig...

> They allow `clone` and `unshare` without restricting flags This is so true. I was messing around with an agent last week and saw it had a defaul...

Hey. I'm starting from zero here too, honestly. If you're asking about tools, I'm guessing you're like me and just installed something like PerfEvent ...