Keynote: eBPF: Unlocking Innovation in the Linux Kernel
summary
eBPF turns multi‑year kernel changes into days by letting small verified bytecode modules load at runtime with a verifier and JIT pipeline, supporting LLVM/GCC front ends and stable IETF‑standard bytecode. Production uses include Android security and Facebook’s layer‑4 load balancer, with roughly ~100 eBPF programs per machine for observability, networking and security. Recent kernel merges: netkit replacing veth to run eBPF closer to apps (Meta reports P99 12s→100ms), SCADAX pluggable schedulers showing up to 10% workload speedups.
AI-written summary · about
chapters (15)
- 0:00eBPF and Linux kernel intro
- 1:03Traditional vs eBPF innovation
- 3:09Safe kernel innovation with eBPF
- 4:14eBPF universal assembly
- 5:17Compiling eBPF programs
- 6:21eBPF runtime model
- 7:24eBPF in large corporations
- 7:44AI flame graphs via eBPF
- 8:49eBPF for Windows security
- 9:33Runtime security with eBPF
- 10:17Schedulers enhanced by eBPF
- 11:21Netkit network optimization
- 12:46eBPF for VM workloads
- 13:52Kernel live patching with eBPF
- 14:34eBPF future and conclusion
related talks
46mThe eBPF Revolution: A Dynamic Linux Kernel
35mKeynote: Cloud Native Superpowers with eBPF
32mExploring the Power of eBPF for System Observability
10mKeynote: eBPF - Everything You Need to Know in 5 Minutes
32meBPF: The Next Power Tool of SREs
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
37mJust Buzz or Real Byte? eBPF in Cloud Native