eBPF: The Next Power Tool of SREs
summary
eBPF is presented as a kernel sandbox that SREs can use for high‑fidelity observability, networking and security by compiling C with clang/LLVM, loading via the bpf syscall, and exchanging data through eBPF maps. Live demos include a hello-world kprobe printing on sys_clone, a disk‑snoop tracer using BCC, and a simple LSM file‑open blocker that denies opens except for PID 1. XDP shows per‑packet load balancing at millions of pps, bounded loops arrive in kernel 5.3 (~1M instructions), Facebook runs ~40 BPF programs, and kernel/version compatibility and perf testing remain critical.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:23Introduction: Michael Kehoe
- 5:54What is eBPF?
- 8:37bpf() system call
- 9:07eBPF Program Types
- 10:21eBPF Map Types
- 10:58eBPF Helpers
- 13:12How to get started with eBPF
- 13:35Where to get started with eBPF: Hello World
- 15:31eBPF Observability
- 17:57Observability: disksnoop.py
- 19:40eBPF Networking
- 23:41eBPF Security
- 25:18Security: LSM example
- 29:54The future of eBPF & SRE: Words of caution
- 31:40Resources
related talks
43meBPF Superpowers for SRE
33meBPF: exploring use case of BPF kernel infrastructure
32mExploring the Power of eBPF for System Observability
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
20mClosing Perspectives
31meBPF 101
16mWhy Everyone Should Care About eBPF
29meBPF on the Rise - Getting Started