Cloud Native eBPF Day North America 2021
2021-10-11
-- online --
[Cloud Native eBPF Day North America 2021, Cloud Native eBPF Day North America 2022]
who it's for
cloud native engineers, security engineers, observability engineers, platform engineers, systems engineers, kernel engineers, tooling and library maintainers
topics
eBPF iterators for collectors; LSM-based eBPF enforcement; seccomp policy generation with eBPF; CO:RE portable BPF objects; eBPF integration with Cilium; eBPF for Windows implementations; systemd libbpf integration; in-kernel continuous profiling; eBPF-based debugging and uprobes; XDP and tc packet processing; bpf maps and ring buffers; embedding BPF objects in Go
| title | author | length |
|---|---|---|
| Welcome + Opening: Why Everyone is Excited about eBPF in Cloud Native in 2021 | Dan Papandrea, Loris Degioanni, Thomas Graf, Liz Rice, Sarah Novotny, Andrew Randall | 25m |
eBPF is presented as a way to safely run small programs in the kernel to get high‑fidelity visibility and change behavior without modules, enabling single… | ||
| eBPF in Microservices Observability | Jaana Dogan | 17m |
eBPF programs get verified and JIT‑compiled, attach to sockets or syscall and tracepoints, and write into bpf maps that a user‑space agent reads; Pixie can… | ||
| A Beginner's Guide to eBPF Programming for Networking | Liz Rice | 30m |
Live-coding shows how eBPF programs actually attach and behave: bcc framework compiles C eBPF and attaches a kprobe to tcp_v4_connect for tracing, a socket… | ||
| Using BPF Iterators to Gain Insight into Kubernetes | Alban Crequy | 19m |
BPF iterators (added in Linux 5.8) let the kernel itself walk tasks and sockets so a 25-line iterator yields one line per thread or TCP socket with a single… | ||
| LSM BPF Change Everything | Leonardo Di Donato, KP Singh | 27m |
Shows that attaching BPF to LSM hooks fixes raceable tracepoint blind spots: tracepoint-based Falco probes are reliably bypassed by argument-swapping while LSM… | ||
| Generating seccomp policies with eBPF | Marga Manterola | 10m |
An eBPF gadget inside inspector-gadget captures every syscall a pod makes and emits a concrete seccomp profile that can be stored in the trace status or pushed… | ||
| The Cross-Platform Future of eBPF | Dave Thaler | 27m |
eBPF is already moving beyond Linux: Microsoft ships eBPF for Windows with a userland loader, an ebpf shim that talks to stable kernel APIs, and the… | ||
| Think eBPF for Kernel Security Monitoring | Eric Sage, Melissa Kilby | 20m |
Apple describes deploying Falco eBPF probe to collect syscall metadata, using libbpf and BTF for compile once run anywhere, and adding kernel-space… | ||
| eBPF & Cillium | Sebastian Duff, Anthony Comtois | 18m |
Sky runs a multi-tenant Kubernetes PaaS hosting ~300 apps, ~60,000 replicas and ~1,000 engineers and adopts Cilium + eBPF to replace iptables for scalable… | ||
| Extending systemd Security Features with eBPF | Mauricio Vásquez Bernal | 21m |
systemd gains libbpf integration and ships two new eBPF-based controls: RestrictNetworkInterfaces and RestrictFileSystems. Each network rule installs tiny C… | ||
| Debuggers and eBPF: Bringing Debugging to Production | Derek Parker | 24m |
A Delve rewrite using eBPF replaces slow ptrace stops with in-kernel probes to trace Go functions with microsecond overhead instead of seconds, using libbpfgo… | ||
| Portable BPF with CO:RE | Grant Seltzer Richman | 21m |
Tracee switches from per-kernel builds to a single libbpf CO:RE object that relocates type offsets using kernel BTF so one compiled .o runs across… | ||
| Building Your Own Kubectl Trace on Steroids Using BPF Libraries in Go, Rust, Python an... | Kyle Quest | 31m |
A Kubernetes tracer that watches file opens and reports process, pid, uid and result gets built end-to-end: a kubectl plugin installs a daemonset which loads… | ||
| Closing Perspectives | Duffie Cooley, Sarah Novotny, Andrew Randall | 20m |
eBPF proves practical across ops, dev, security, kernel and infra roles: bpftrace and libraries deliver on-the-spot telemetry for SREs; automatic… | ||
| nothing matches | ||