Think of it like small, isolated programs that run in a VM that is managed by the kernel and has access to many kernel APIs and datastructures without needing t

Think of it like small, isolated programs that run in a VM that is managed by the kernel and has access to many kernel APIs and datastructures without needing to do syscalls. I believe they can both monitor and manipulate data as it flows through the OS primatives (sockets, file descriptors, etc.).