Resolving Performance and Security Issues with eBPF
summary
eBPF is shown as a kernel‑embedded VM that runs verified bytecode so monitoring hooks can catch ultrafast process creation that top misses; the demo uses execs via BCC/BPFTrace to log every execve and reproduces how that revealed a ransomware spawning in nanoseconds. Slides list 131 built‑in tools (181 combined). A kernel policy example compiles a seccomp filter blocking mmap (returns EINVAL) to sandbox containers, and verified bytecode prevents kernel crashes while still adding measurable overhead when widely applied.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:50What is eBPF
- 8:13eBPF journey and kernel
- 14:58Traditional vs eBPF monitoring
- 21:42Catching malicious processes
- 23:45Antiviruses using eBPF
- 26:17eBPF in container security
- 33:50Q&A
related talks
40mExploring Runtime Security and Forensic using eBPF
38mLinux Kernel Tracing Using eBPF
32meBPF: The Next Power Tool of SREs
36meBPF for Runtime Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
31meBPF 101
14mWill eBPF Save Us From the Next Global Outage?
43meBPF Superpowers for SRE