The art of writing eBPF programs

#1

Post by leakybucket » Wed, Feb 27, 2019, 8:12 PM UTC

The art of writing eBPF programs
sysdig.com

Re: The art of writing eBPF programs

#2

Post by deanmoriarty » Wed, Feb 27, 2019, 9:46 PM UTC

This is very interesting. I dabbled with eBPF before using the more traditional bcc tools and the canned scripts, but this deep dive really gives a good perspective on the implementation underneath.

I wonder how long before we will see more critical parts of the kernel machinery being implemented completely in eBPF (like XDP currently). Fascinating technology!

Re: The art of writing eBPF programs

#3

Post by tzhenghao » Thu, Feb 28, 2019, 12:50 AM UTC

There's also this 2017 LWN article on eBPF [1] which I find very interesting.

[1] - https://lwn.net/Articles/740157/

Re: The art of writing eBPF programs

#4

Post by stdcli » Thu, Feb 28, 2019, 1:12 AM UTC

I logged in just to say this: I love the sysdig engineering blog. Please don't stop writing blogposts. sysdig and clouflare are becoming my favorite engineering blogs.

Re: The art of writing eBPF programs

#5

Post by deanmoriarty » Thu, Feb 28, 2019, 1:34 AM UTC

stdcli wrote: post #4

I logged in just to say this: I love the sysdig engineering blog. Please don't stop writing blogposts. sysdig and clouflare are becoming my favorite engineering blogs.

I agree. One of my all time favorites was https://sysdig.com/blog/container-isolation-gone-wrong/, it kept me hooked til the last line, like a thriller ^_^

Re: The art of writing eBPF programs

#6

Post by mjcohen » Thu, Feb 28, 2019, 3:36 AM UTC

Took me a while to find that eBPF was extended/enhanced Berkeley Packet Filter. Wikipedia was no help.

Re: The art of writing eBPF programs

#7

Post by aargh_aargh » Thu, Feb 28, 2019, 9:22 AM UTC

mjcohen wrote: post #6

Took me a while to find that eBPF was extended/enhanced Berkeley Packet Filter. Wikipedia was no help.

While that's the original meaning of the acronym, it was generalized into a virtual machine, so it has come far from being able to just filter packets.

More details under "BPF kernel internals" here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

Re: The art of writing eBPF programs

#8

Post by blunte » Thu, Feb 28, 2019, 9:36 AM UTC

mjcohen wrote: post #6

Took me a while to find that eBPF was extended/enhanced Berkeley Packet Filter. Wikipedia was no help.

Just one place early on this page using the full words instead of the acronym would have done the job. Such a small change would make such an immense difference for outsiders.