Extending Applications Safely and Efficiently
summary
EIM models each extension feature as a named resource and splits work into a developer-made capability map and a deployment-time YAML that grants a minimal permission set; bpftime enforces those specs with offline eBPF-style verification, Intel MPK isolation, dynamic binary rewriting, and in-process trampolines. A prototype implements six real apps (firewall, observability, GPU, etc.), shows up to 6× better throughput vs WASM-style frameworks, reports 2% overhead for a firewall path where WASM costs 11–12%, and cuts a kernel-eBPF monitoring hit from 28% to 7%. Open source on GitHub.
AI-written summary · about
chapters (7)
- 0:00Introduction to extensions
- 2:07Problems and requirements
- 4:11Proposed solution overview
- 5:32Extension interface model
- 9:20The bpftime runtime
- 12:05Evaluation and results
- 14:23Conclusion and Q&A
related talks
31meBPF and Wasm: Unifying Userspace Extensions With Bpftime
42mResolving Performance and Security Issues with eBPF
14mWill eBPF Save Us From the Next Global Outage?
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32meBPF: The Next Power Tool of SREs
33meBPF: exploring use case of BPF kernel infrastructure
43meBPF Superpowers for SRE
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security