eBPF on the Rise - Getting Started
summary
eBPF provides safe, JIT-compiled kernel bytecode that the verifier forces to terminate and prevents OOB memory access, now supporting up to one million instructions and about 31 program types. Tooling includes clang/llc -> ELF bytecode, bpftool, bcc, bpftrace, libbpf (Go bindings) for loading, tracing and inspecting. Real deployments replace kube-proxy with an eBPF data path that turns linear iptables lookups into a single hashmap lookup, upgrades without packet loss, and yields large latency and CPU savings in production.
AI-written summary · about
chapters (27)
- 0:00Intro
- 0:55In-Kernel, Safe and Flexible Programs
- 2:26extended Berkeley Packet Filter
- 4:43Communicate with Maps
- 5:24A Powerful Execution Engine
- 6:09Countless Use Cases
- 9:11LLVM Backend to the Rescue
- 9:46Example: Networking
- 10:56Example: Tracing With BCC
- 11:59BCC Tools: Opensnoop
- 12:29BCC Tools: CPU Profiling, Flame Graphs
- 13:34BCC Tools (2019)
- 14:04Bpftrace for Powerful One-Liners
- 15:03Build Your Own: Libraries
- 15:59Bpftool: Manage eBPF Objects
- 16:33Bpftool: Inspect Programs
- 16:47Bpftool: Manage Maps
- 17:21The Force is Strong With eBPF
- 20:01Tracing Pods in a Kubernetes Cluster
- 20:37Mastering Networks With Cilium
- 21:50Cilium's Optimized Datapath
- 22:49Cilium Use Cases for eBPF
- 23:07In the Wild
- 24:10A Thriving Ecosystem
- 25:31On the Rise
- 26:22Wrapping Up
- 28:12Thank You!
related talks
33meBPF: exploring use case of BPF kernel infrastructure
16mWhy Everyone Should Care About eBPF
20mGentle Introduction to EBPF
32meBPF: The Next Power Tool of SREs
01h 18mTutorial: Getting Started with eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
29mBuzzing Across the Cloud Native Landscape with eBPF
01h 07meBPF: Fueling New Flame Graphs & more