--- title: "Instrumenting CI/CD Pipelines via Syscall Interception" url: https://daily.dev/posts/instrumenting-ci-cd-pipelines-via-syscall-interception-td6x99mna source_url: https://earthly.dev/blog/instrumenting-cicd-syscall-interception/ type: article source: "Earthly" published: 2026-01-21T22:49:23.111Z updated: 2026-01-21T22:49:49.671Z tags: ["security", "linux", "cicd", "observability", "opentelemetry"] reading_time: 13 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Instrumenting CI/CD Pipelines via Syscall Interception **[Earthly](https://daily.dev/sources/earthly)** · 13 min read · 1 upvotes · 0 comments ## Summary A CI agent uses Linux syscall interception (ptrace + seccomp-bpf filters) to instrument CI/CD pipelines without modifying them. By intercepting only execve syscalls, it achieves near-zero overhead (<0.1%) while capturing complete visibility into process execution, timing, tool versions, and environment configuration. The agent can attach to running processes, making it compatible with managed runners like GitHub Actions. Use cases include automatic OpenTelemetry tracing, test coverage collection, security scanner enforcement, dependency graph extraction, and custom metadata collection. The approach enables centralized observability and policy enforcement across all pipelines without per-repository configuration changes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Unlocking CI/CD success with observability](https://daily.dev/posts/unlocking-ci-cd-success-with-observability-us7lxbswk) · Dynatrace · 1 upvotes · 0 comments - [What Makes System Calls Expensive: A Linux Internals Deep Dive](https://daily.dev/posts/what-makes-system-calls-expensive-a-linux-internals-deep-dive-pmcqgjl8m) · Confessions of a Code Addict · 13 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#cicd](https://daily.dev/tags/cicd), [#observability](https://daily.dev/tags/observability), [#opentelemetry](https://daily.dev/tags/opentelemetry) [View this post on daily.dev](https://daily.dev/posts/instrumenting-ci-cd-pipelines-via-syscall-interception-td6x99mna)