Exploring the Power of eBPF for System Observability
summary
Claims that eBPF lets teams get kernel-level signals in days not years by compiling bytecode, passing a kernel verifier, and loading sandboxed programs. A BCC Python example compiles eBPF, hooks the clone syscall and prints a hello world; ebpf maps aggregate kernel events so user space pulls summaries (short‑lived processes, exit codes, OOM kills) instead of a firehose. Networking examples show XDP firewall dropping ICMP before tcpdump sees packets and Cilium replacing iptables with fast map lookups; Tetragon uses a Kubernetes CRD to detect and block reads of /etc/shadow on a three‑node cluster.
AI-written summary · about
chapters (10)
- 0:00The problem with kernels
- 2:12Introduction to eBPF
- 5:21Core eBPF architecture
- 9:34Practical eBPF example
- 11:57Data exchange via maps
- 14:07Observability in action
- 18:04Networking with eBPF
- 21:21High-performance filtering
- 24:04Security with Tetragon
- 27:44Conclusion and Q&A
related talks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32meBPF: The Next Power Tool of SREs
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
30mObservability in Kubernetes: Unlocking the Power of eBPF
43meBPF Superpowers for SRE
46mThe eBPF Revolution: A Dynamic Linux Kernel
31meBPF 101- 40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools