eBPF Superpowers for SRE
summary
eBPF lets operators load verified programs into the Linux kernel to observe or change events at syscall and networking hooks; the verifier prevents typical kernel-crashing bugs. Demos show tracing with openSnoop and Kubernetes-aware Inspector Gadget, cluster aggregation with Pixie, and Cilium dataplane + Hubble for flow visibility yielding up to 40% network gains. A live demo drops ~40 ping packets when a filter is applied, and Tetragon enforces a policy that kills a process trying to write /etc/passwd, preventing the write.
AI-written summary · about
chapters (9)
- 0:00Introduction to eBPF
- 2:28Kernel instrumentation demo
- 7:05Observability and tracing
- 9:41Safety and verification
- 12:39Mitigating vulnerabilities
- 17:01Cloud native and sidecars
- 24:35Networking performance
- 28:21Security enforcement
- 40:33Conclusion and resources
related talks
32meBPF: The Next Power Tool of SREs
32mExploring the Power of eBPF for System Observability
36meBPF for Runtime Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
39meBPF Superpowers for Go programmers
29mBuzzing Across the Cloud Native Landscape with eBPF
33meBPF: exploring use case of BPF kernel infrastructure