Cilium - Container Security and Networking Using BPF and XDP
summary
Cilium is an agent that compiles and injects BPF/XDP bytecode into the kernel to do networking, load balancing and security at line rate. Demonstrated results include drops 16M pps vs 7.1M for a DDoS filter and 31s rule load vs 3+ min for IPtables; Facebook reports ~10x throughput switching IPVS→XDP. Cilium enforces label-based L3/L4 policies, routes via overlay or native mode, performs Layer‑7 via Envoy sidecars with kTLS/socket redirect, and supports live hot-replace without lost connections plus high‑volume visibility via perf ring buffers.
AI-written summary · about
chapters (21)
- 0:00Intro
- 2:01BPF is revolutionizing... Tracing / Profiling
- 4:59Facebook published BPF/XDP numbers for L3/L4 LB at Netdev 21
- 6:50BPF Revolution #3: Security
- 7:20Evolution of Application Design & Delivery Frequency
- 9:41Network Security for Microservices
- 10:09Gordon wants to build a service to tweet out all job offerings.
- 10:59Gordon uses mutual TLS Auth Good thinking Gordon
- 11:26The security team has L3/L4 network security in place for all services
- 12:30Back to the drawing board...
- 22:40Kubernetes Integration
- 26:00Should I encapsulate or not?
- 27:34L3 Policy (Labels Based)
- 28:06L3 Policy (CIDR)
- 29:08Policy - Only allow GET /v1
- 29:49How are these policies enforced?
- 30:15What is a sidecar proxy?
- 31:19Networking Path with a Sidecar
- 32:24Kernel Proxy
- 36:08Socket Redirect - Performance?
- 37:03The Before and After
related talks
24mThe Cilium Story - Why We Created Cilium
11mCilium Service Mesh
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
07mThe Cilium Vision
20mTackling Container Networking at Scale
05mLightning Talk: Unveiling 5 Essential Insights from Cilium Implementation in a...
05mUnlocking Next-Gen Networking and Security with Cilium Service Mesh
43mA Guided Tour of Cilium Service Mesh