Create
socket
socket
Bind to
IPv4:Port
bind
Start
listening
listen
Accept
connection
accept
Create child
process
clone3
Parent?
yes — parent loops back, keeps listening
no (child)
// child process
Detach from
parent
setsid
Receive
file size
recvfrom
size
OK?
no
yes
Create file
in RAM → FD
memfd_create + MFD_EXEC
Expand
to file size
ftruncate
Map memfd as
shared memory
mmap + MAP_SHARED
Receive content
into mmap
recvfrom
data
OK?
no
yes
Unmap shared
memory
munmap
Redirect stdio
to socket
dup3
fd
< 3?
yes
no
Exec the
content
execveat + AT_EMPTY_PATH
LEGEND
NODES
Operation
Blocking / loop point
Decision
End of flow
LABELS
syscall
Linux syscall
FLAG
Syscall flag / modifier
CONNECTORS
Flow direction
Loop back
Child process scope