Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Beginner's Guide to eBPF

github.com

Post reply on HN
Print view View original

51–60 of 78 posts

Re: A Beginner's Guide to eBPF

#51

Post by vilaca »

awesomegoat_com wrote: post #39
Paul-Craft wrote: post #10

This may prove useful: > eBPF (often aliased BPF)[2][5] is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.[6] It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.[7] Safety is provided through an in-kernel verifier which performs static code analysis and rej…

Haven't sandboxed programs in a privileged context been the root cause of me seeing BSOD so often in the late 90ties?

AFAIK the cause of BSOD were, among others, the lack of sandboxing.

Re: A Beginner's Guide to eBPF

#54

Post by cassianoleal »

Temporary_31337 wrote: post #43
anonymousDan wrote: post #36

Earlier quoted context omitted.

Why in cloud environments?

You don’t want kernel panic affecting other users

Why would your cloud instance panicking affect other users of the cloud provider?

Or do you mean something else?

Re: A Beginner's Guide to eBPF

#56

Post by bionsystem »

cassianoleal wrote: post #54
Temporary_31337 wrote: post #43

Earlier quoted context omitted.

You don’t want kernel panic affecting other users

Why would your cloud instance panicking affect other users of the cloud provider? Or do you mean something else?

Anecdotically, I had the case on VMWare 4 (that was in 2012 or 2013) that a Solaris 11 VM managed to reboot the entire ESX it was hosted on. Very weird bug where ESX passed through some interrupt or something.

But in this case I think they mean on the same machine. "In production" would be more accurate than "in a cloud environment". And yeah I wouldn't load custom kernel modules in production just to do observability.

Re: A Beginner's Guide to eBPF

#57

Post by kqr »

Glemotooo wrote: post #48
awesomegoat_com wrote: post #39

Earlier quoted context omitted.

Haven't sandboxed programs in a privileged context been the root cause of me seeing BSOD so often in the late 90ties?

I'm only aware of drivers, which were not sandboxed due to the nature of drivers (at least in late 90ties there was pobably not much of abstraction on that level, kernel features, hardware features available?)

There was -- Minix was developed in the 90s and ran drivers in user space. But it was (perceived to be?) slow, so mainstream OSes did not do it.

Re: A Beginner's Guide to eBPF

#58

Post by qubit0ne »

jrpelkonen wrote: post #55
qubit0ne wrote: post #53

In case anyone is interested in writing eBPF programs in Rust https://github.com/vishpat/oxidize-ebpf

I don’t have any experience with this project, but Aya seems more vibrant, https://aya-rs.dev/

Aya is one of the most under-rated eBPF projects.

Re: A Beginner's Guide to eBPF

#59

Post by kqr »

cassianoleal wrote: post #54
Temporary_31337 wrote: post #43

Earlier quoted context omitted.

You don’t want kernel panic affecting other users

Why would your cloud instance panicking affect other users of the cloud provider? Or do you mean something else?

Cloud goes beyond rented VMs. Fully managed cloud services have thousands or millions of production customers on the same node. They have to be very careful about what they run as root.

Re: A Beginner's Guide to eBPF

#60

Post by blipvert »

kqr wrote: post #34

Ever since Brendan Gregg started using eBPF for observability back in 2015 I've had the sense that eBPF is an extremely underrated tool of the future. I really would like to learn it, but beyond some improvised bpftrace scripting and the tools that come with bcc, I've not really had the need. What custom usage do you have for it?

I’ve used it to write a layer 4 load balancer to replace old hardware appliances. Similar to Facebook’s Katran, but switches traffic at layer 2 (rather than L3) for compatibility and in Go rather than C++,’cos I’m not a great coder ;-)
Post reply on HN