Will eBPF Save Us From the Next Global Outage?
summary
Argues that eBPF lets vendors run safe, high-performance kernel-level security by verifying loaded programs before they execute, reducing risk of kernel crashes. Demonstrates a containerized exploit of a vulnerable liblzma SSH scenario that a Tetragon policy would detect and kill the SSH process, preventing file write. Shows measured overhead: a 1.5 million file-access baseline produces ~2,000 events/sec at ~2% CPU. Live demo fails but the tool and verifier are production-ready.
AI-written summary · about
chapters (5)
- 0:00Introduction to eBPF
- 2:27Why security tools run in kernel
- 5:22eBPF safety and verification
- 8:15Demo of Tetragon tool
- 12:55eBPF future and resources
related talks
42mResolving Performance and Security Issues with eBPF
36meBPF for Runtime Security
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32mReal Time Security - eBPF for Preventing attacks
43meBPF Superpowers for SRE- 40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32meBPF: The Next Power Tool of SREs