Debugging Kubernetes and Container Workloads with the Superpower of eBPF
summary
Shows eBPF used to filter per-container by pinning a BPF map with a mount namespace ID (manual hex formatting, procfs lookup, then inject) and demonstrates how that workflow is fragile. Presents Inspektor Gadget running as a daemonset and CLI that provides container-aware exec tracing, container name columns, and kernel-side filtering so events map to pods. Describes building and pushing OCI-packaged gadgets (metadata, maps, eBPF objects) and running them with cctl gadget run — it works and removes manual map fiddling.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:42What is eBPF and why it matters
- 2:48Debugging challenges with raw eBPF
- 3:53Live demo filtering containers with BCC
- 7:53Limitations of manual eBPF debugging
- 8:57Introducing Inspector Gadget
- 10:44Live demo debugging with Inspector Gadget
- 12:29Solutions from Inspector Gadget
- 13:10Inspector Gadget as a framework
- 14:58Demo building custom eBPF gadgets
- 17:48Publishing and deploying gadgets
- 19:00Contributing to Inspector Gadget
- 19:57Q&A
related talks
13mTalk Deep Dive
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
25mProtecting Modern Workloads with eBPF superpowers
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
37mOvercoming the Challenges of Debugging Containers - Jose Blanquicet