Evolution of Direct Server Return (DSR) implementation for containerized applications
summary
Meta replaces IPVS with BPF XDP and reports handling ~3x more traffic using ~7x less CPU, then builds XDP Chainer to let multiple teams attach ordered XDP programs but finds upgrades require draining slots and containers need root. Moving decapsulation into the container veth with TC-BPF decap removes tun double-pass latency, eliminates elevated privileges, and matches XDP performance within ~6% runtime while exposing hardware-specific bugs (mangoc/rcom behaviors) and increased softirq on veths that require further mitigation.
AI-written summary · about
chapters (15)
- 0:00Introduction to DSR evolution
- 1:07Load balancer basics and DSR
- 2:12IPVS limitations and BPF XDP shift
- 3:59XDP production challenges
- 5:30XDP chainer architecture
- 7:41XDP decapsulation issues
- 9:06Cross-impact risks in containerized setups
- 10:10Network namespaces for isolation
- 11:37Namespace-based decapsulation idea
- 13:05Kernel module latency problems
- 13:26TC-based decapsulation solution
- 14:34TC vs XDP performance comparison
- 16:45Hardware-specific TC bugs
- 18:35CPU utilization in DSR path
- 19:16Conclusion and Q&A
related talks
37mEfficient and Flexible Virtual Machine Networking Through eBPF
32meBPF: BPF kernel infrastructure
51mAccelerate containers and VMs networking with vDPA
33mBringing packet queueing to XDP
23mMigrating from DPDK to AF_XDP for High-Performance Networking in...
21mHow to Use XDP and eBPF to Accelerate IPSec Throughput by 400%
36mBringing vDPA to Life in Kubernetes
16mElectrode: Accelerating Distributed Protocols with eBPF