Unlocking the kernel

eBPF

Revolutionizing development, enabling efficient networking, observability, tracing, and security. The foundation for Isovalent’s products.

Getting kernel superpowers into everyone’s hands

eBPF is a revolutionary technology that has origins in the Linux kernel and can run sandboxed programs in a privileged context such as the operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules.


Why eBPF?

  • Performance

    eBPF drastically improves processing by being JIT compiled and running directly in the kernel.

  • Security

    eBPF programs are verified to not crash the kernel and can only be modified by privileged users.

  • Flexibility

    Modify or add functionality and use cases to the kernel without having to restart or patch it.

documentary

eBPF's Creation Story - Unlocking the Kernel

A story of friends creating a technology that is often barely visible but can be found in most devices today. It has changed the tech industry significantly and will continue to do so in the coming years.

How the hive came to bee

How does eBPF allow us to rethink the way we solve problems? What are the use cases solved by eBPF? How does eBPF make Cilium a fundamentally better dataplane? To answer these questions, we asked the creators and maintainers of these projects.

This history of eBPF

John starts by going back to the "early days" of 2014 and the main projects, companies and players that influenced the landscape of Linux networking at the time. It was around then that he saw a "switch-o-pocalypse" where virtual networkings protocols and models were being built seemingly every other day (VXLAN, STT, OVS, etc...). Meanwhile, it was around that time that containerization started to take off and that Kubernetes' first commit was made.

The highly dynamic networking requirements from containerized applications required speed of innovation that simply wasn't possible due the slow feedback loop in the Linux development model.

And that's really how and why eBPF got started.

A technical deep dive of eBPF

Daniel starts by answering the question "What is BPF/eBPF?" ("a framework to extend the OS kernel") before covering, at a high-level, the ever-growing list of use cases (networking, observability, security enforcement, tracing and profiling, etc...).

Daniel explains some of the differences between user, kernel and BPF software - some of the pros and cons of each model and in particular some of the security benefits of eBPF. As you'll see in the video, eBPF is becoming a common denominator for many projects in networking, tracing and security.

Daniel takes us through a "toy" eBPF program and the various steps in its deployment (from BPF C code, to BPF compiler backend, to BPF loader to finally BPF runtime). He takes the time to walk through complex parts of BPF, such as the safety provided by the BPF verifier and how it works by simulating execution of all paths of the program.

Cilium as an eBPF use case

Joe explains why traditional IP-based security is no longer feasible in the highly dynamic world of cloud native application. Joe talks about the intent of security policies (they are not based on where the app is but who the app is) and how eBPF and Cilium can enforce network policies based on much richer data (in addition to IP addresses: Kubernetes namespace, labels, DNS-awareness, SPIFFE, etc...). Policies can be written and be enforced using these precise identities.

Observability is another major use case of eBPF. Joe takes us back to the ancestor of eBPF (tcpdump) and how useful it was to dissect the traffic but he also highlights its limitations in the world of cloud native when users need more than just an IP address to identify traffic - they want to associate it with a container/Pod. Hubble provides the ability to link the identities previously discussed with their actual flow metadata: Ethernet headers, IP & ICMP headers, UDP & TCP ports, HTTP/DNS/Kafka, etc... Hubble works seamlessly with Cilium by even reporting when flows are dropped by a specific Cilium Network Policy.


Getting Started with eBPF

  • Getting started with eBPF

    eBPF is the new standard to program Linux kernel capabilities in a safe and efficient manner without requiring to change kernel source code or loading kernel modules. It has enabled a new generation of high performance tooling to be developed covering networking, security, and observability use cases.

    The best way to learn about eBPF is to read the book "What is eBPF" by Liz Rice. And the best way to have your first experience with eBPF programming is to walk through this lab, which takes the opensnoop example out of the book and teaches you to handle an eBPF tool, watch it loading its components and even add your own tracing into the source eBPF code.

  • What is eBPF?

    In this short brief, get the gist of what is eBPF, why to use it, and what the foundation behind means for the long term project.

  • Learning eBPF Tutorial

    If you enjoy this tutorial and would like to dive deeper, you may like to consider Liz's book published by O'Reilly, Learning eBPF. You can also download an electronic copy from Isovalent's web site.