Beyond Power and Magic: Forging Stable eBPF Tools for the Post-Demon King Era
summary
Compares fragile attachments like kprobes with newer contracts such as fentry/fexit and kfuncs and shows that using BTF and CO-RE lets eBPF programs adapt across kernel versions without constant rewrites. Describes a tested ordering mechanism, the BPF preloader, to avoid race and conflict when many programs attach to the same hook. Details concrete platform pieces: Maglev for consistent-hash load balancing, Tetragon and Hubble for behavior enforcement and packet-level observability, and argues these practices materially improve durability across kernel upgrades.
AI-written summary · about
chapters (15)
- 0:00Post-demon king era intro
- 3:20Magic to stable eBPF tools
- 5:47Ancient spells and kernel evolution
- 8:37Structured guilds for eBPF
- 11:50BTF and CO-RE runes
- 13:58Kernel evolution battle
- 16:29BPF preloader and execution
- 17:53AI feedback for eBPF
- 18:56Durability for Cilium and Tetragon
- 19:17Maglev load balancing
- 21:02Hubble observability
- 22:05Tetragon security barrier
- 24:56eBPF longevity focus
- 26:00eBPF resources and community
- 27:26Q&A
related talks
33meBPF: exploring use case of BPF kernel infrastructure
32meBPF: The Next Power Tool of SREs
50mIntroduction to eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
36mSecuring the Superpowers: Who Loaded That EBPF Program?
29meBPF on the Rise - Getting Started
36meBPF for Runtime Security
32mExploring the Power of eBPF for System Observability