Into the hive of eBPF!
summary
eBPF lets code run inside the Linux kernel at native speed by compiling C/Rust into bytecode, passing a strict verifier that prevents infinite loops and illegal memory access, then JITting to native code; the presenter shows a BCC (Python) demo and an XDP Rust load balancer (Dockerized) that successfully flips traffic between two backends. eBPF uses maps to share state with user space, BTF solves kernel-header mismatches, and users report CPU for a legacy userspace L4 load balancer dropping from ~20% to near 0%, while sidecars cost ~2–5% overhead.
AI-written summary · about
chapters (15)
- 0:00eBPF introduction
- 5:55BPF history and evolution
- 11:14Why eBPF extends Linux kernel
- 18:23Verifier and JIT compilation
- 22:03eBPF attachment points
- 24:28eBPF Maps and data sharing
- 29:08eBPF helpers and functions
- 31:18eBPF use cases in networking and security
- 34:11Tools and languages for eBPF
- 37:44Cross-version compatibility with BTF
- 38:05Demo: eBPF load balancer in Rust
- 43:01When to use eBPF
- 44:04Popular eBPF tools
- 45:50eBPF in cloud-native
- 46:52eBPF for Windows and trends
related talks
47mInto the Heart of the eBPF Hive!
32meBPF: BPF kernel infrastructure
31meBPF 101
46mThe eBPF Revolution: A Dynamic Linux Kernel
46mTracing the Linux kernel with eBPF and Rust
15mKeynote: eBPF: Unlocking Innovation in the Linux Kernel
32mExploring the Power of eBPF for System Observability
32mBuzzing across the eBPF Landscape and into the Hive