Container Networking: The Play of BPF and Network NS with different...
summary
Shows that per-container IPv6 plus cgroup-bpf bind/connect/sendmsg actually lets multiple containers bind the same port by rewriting bind and source addresses, but wildcard binds, UDP and host wildcard services break that model. When those limits bite, full network namespaces with virtual links (veth, netkit/lkit, IPVLAN, SR-IOV) are used; benchmarks measure CPU system and softirq time, with optimized BPF (avoid FIB lookups) closing the gap so IP L2 approaches bare metal and remaining overhead is ~1% CPU. A practical fix for UDP is BPF redirect to loopback to avoid costly host traversal.
AI-written summary · about
chapters (11)
- 0:00Introduction to container networking
- 1:04BPF and network namespaces overview
- 3:54Port isolation challenges without namespaces
- 5:18Using cgroup BPF for container identity
- 7:25Limitations of cgroup BPF solutions
- 9:09TLS interception with cgroup BPF
- 10:11Multi-tenant and multi-host scenarios
- 11:59Evolution to network namespaces
- 14:49Performance evaluation of virtual devices
- 21:49Benchmarking results and optimizations
- 22:13Q&A session
related talks
30mA Beginner's Guide to eBPF Programming for Networking
32mCF Networking: All Your Packets are Belong to Us
32mOverview of the BPF networking hooks and user experience in Meta
29mContainer Networking in Cloud Foundry
34mTroubleshooting Low Latency Application on CNF Deployment
37mEfficient and Flexible Virtual Machine Networking Through eBPF
43mPanel Discussion: Containers and Networking: A Symbiotic Relationship
32meBPF: BPF kernel infrastructure