The eBPF Revolution: A Dynamic Linux Kernel
summary
eBPF lets teams inject verified bytecode into the Linux kernel at runtime so custom callbacks run at kernel speed, dramatically shortening rollout time. Real deployments use Cilium, Hubble, Tetragon and BCC/XDP to provide kernel‑level observability, drop malicious packets before they reach the network stack, implement Google’s Maglev load balancing and BBR congestion control; Cilium also replaces iptables’ linear rule cost with near‑constant lookup performance and is production‑proven by major cloud providers.
AI-written summary · about
chapters (11)
- 0:00eBPF introduction
- 3:21eBPF fundamentals
- 8:56eBPF security
- 11:54eBPF maps and kernel-user
- 13:19Cloud-native eBPF benefits
- 15:46eBPF tools and projects
- 16:48eBPF observability in Cilium/Hubble
- 26:46eBPF network optimization in Cilium
- 35:17Runtime security with eBPF/Tetragon
- 37:25eBPF future and trends
- 38:46Q&A
related talks
15mKeynote: eBPF: Unlocking Innovation in the Linux Kernel
33mThe Future of eBPF in Cloud Native
29mBuzzing Across the Cloud Native Landscape with eBPF
32mExploring the Power of eBPF for System Observability
37mJust Buzz or Real Byte? eBPF in Cloud Native
47mInto the Heart of the eBPF Hive!
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
46meBPF Revolution: a dynamic Linux kernel