Learn how eBPF evolved from the classic Berkeley Packet Filter (BPF) and why the names are now used interchangeably in the Linux community.
The Linux kernel manages all system resources, and modifying it historically required either a lengthy core contribution process or maintaining unstable kernel modules.
An eBPF program is compiled to bytecode, validated by a verifier for safety, and then JIT-compiled into native code that runs securely inside the kernel.
This simple Python demo illustrates how eBPF programs can be loaded and updated in a running kernel, highlighting benefits like security, efficiency, and continuous delivery.
Discover the essential building blocks of eBPF, including event-driven hooks, key-value maps for state management, and helper functions for interacting with the kernel.
Explore how eBPF is used for network optimization, security, tracing, and profiling, along with popular libraries for Go, Rust, and Python.
The 'Compile Once, Run Everywhere' (CORE) principle, enabled by BPF Type Format (BTF), solves the challenge of running eBPF programs across different kernel versions.
Review popular eBPF-based tools like Cilium and Katran, see how eBPF is changing the sidecar model, and look ahead to its future in hot-fixing and microkernels.
09:03Ayesha Kaleem
21:49Reinhard Kugler
26:48Ozan Sazak
30:58Edoardo Dusi
30:51Soroosh Khodami
28:26Igor Todorovski
19:39Andrew Waafa
29:22Alayshia Knighten
Jobs that call for the skills explored in this talk.
Peter Park System GmbH
München, Germany
Peter Park System GmbH
München, Germany
SYSKRON GmbH
Regensburg, Germany
BWI GmbH