It's Halloween, So Here's My Field Guide to the Monsters Already Living in Your Stack

Seven creatures, one per audit: the Zombie process, the Ghost cron, the Trojan paste, the Spider at the door, the Gremlin in CI, the Kraken in the schema, and the Daemon you should adopt. Each with its habitat, its detection one-liner, and its banishment.

Every infrastructure has a bestiary. Nobody writes it down, which is why the monsters keep winning. Mine got catalogued one audit at a time over a year of confessions on this blog — seven distinct creatures, every one still living in somebody's production right now. It's Halloween, so: name them, detect them, banish them. Or adopt them, in one case. Field guides are honest about which animals are pets.

The Zombie 🧟
Died once, kept walking. Deprecated services still serving, restart loops older than the intern who "fixed" them.

# dead-but-walking in the process table
ps -eo pid,ppid,stat,comm | awk '$3 ~ /^Z/'
# and the container flavor: restart loops
docker ps -a --format '{{.Names}}\t{{.Status}}' | grep -iE 'restart|back-off'

Banish: graveyard rules — kill it fully (process, DNS, keys, CI variables) or adopt it with an owner. Half-killed zombies are how sequels happen.

The Ghost 👻
The spirit of a departed colleague, still doing their job. Ours ran at 3:07 AM and reconciled invoices.

for u in $(cut -d: -f1 /etc/passwd); do
  crontab -l -u "$u" 2>/dev/null | grep -vE '^\s*#|^\s*$' | sed "s/^/$u: /"
done   # every line that can't name an owner, on purpose, is a ghost

Banish: the séance — owner, purpose, loud failure, or a funeral. Plus staleness alerts: a ghost that stops working is an incident nobody feels for three weeks.

The Trojan 🐴
Arrives as a gift, opens the door from inside. Pasted snippets, dependency diffs, October PRs titled fix typo.

git diff main...HEAD | grep -nE 'process\.env|os\.environ|getenv'      # env going somewhere
git diff main...HEAD | grep -nE 'base64|eval\(|atob'                   # obfuscation
git diff main...HEAD | grep -nE 'curl .*(-d|--data)|wget |fetch\('     # new outbound call

Banish: review before merge even at twenty lines; provenance comments; pin what you can pin. Most Trojans aren't malicious — just someone else's bug, fossilized with full rights.

The Spider 🕷️
The internet's automated fauna, patiently trying every handle. Lives on your public address and every port you forgot

# before: the porch the spiders sit on
ss -tlnp | grep -E '0\.0\.0\.0|::'          # listeners facing everyone
journalctl -u ssh --since yesterday | grep -c 'Failed password'

# after (no public IP, default-deny, managed ingress): both commands return silence
krova tcp list web-1                        # empty. no porch, no spiders.

Banish: don't fight it at the door; remove the door. My spider population went extinct in a weekend and I did nothing heroic — just changed the default. (The one entry where my hosting is the whole spell: Krova Cubes ship with no public address.)

The Gremlin 👺
Feeds on observation. The CI-only failure, the bug that vanishes under the debugger, timestamps disagreeing by exactly one hour in exactly one region.

# evict its conditions: unseeded randomness and un-pinned clocks in tests
grep -rnE 'Math\.random|random\.random|Date\.now|time\.now' tests/ src/ \
  | grep -viE 'seed|fake|clock'             # every hit is a gremlin bed

Banish: you don't kill gremlins, you bore them out: fixed clocks, seeded randomness, reproducible builds. Boredom is the only exorcism that holds.

The Kraken 🐙
Too big to fight, too central to flee. Tentacles in every schema; migrations scheduled in quarters; a cloud labeled LEGACY.

# count the tentacles before you wake it
grep -rc 'legacy_orders' --include='*.sql' --include='*.py' --include='*.ts' . \
  | sort -t: -k2 -rn | head

Banish: nobody slays the Kraken. Build seams, route one tentacle at a time around it, let it sleep. Anyone selling you a slaying is selling you an outage.

The Daemon 😇
The only monster that works for you. Night-shift process keeping caches warm, certs renewed, queues drained. A daemon is not a demon — it's a guardian spirit we forgot to thank.

systemctl list-units --type=service --state=running --no-pager \
  | awk '{print $1}' | grep -vE '^\.|systemd|ssh|cron'   # your daemons
# adoption papers per daemon: owner, runbook path, silence alert

Banish: absolutely not. Adopt: name it, log it, alert on its silence. A daemon with an owner is infrastructure; a daemon without one is next year's Ghost.

The honest part
None of these are moral failures. Every stack I've audited hosted at least four of the seven simultaneously. The monsters aren't the shame; the unnamed monsters are. An inventory turns fear into a checklist, and a checklist turns 3 AM into Tuesday.

And the seventh entry is the lesson: the difference between a guardian and a ghost is rarely the creature. It's whether somebody wrote its name down.

Name your monsters
Tonight of all nights: run the seven detections. Seven chairs at the table; see who sits down. Then write the field guide — one page per monster: habitat, tells, banishment, or adoption papers if it earns them.