eBPF
eBPF runs “sandboxed programs within the operating system” (the Linux kernel) without changing kernel source or loading modules — programmability “decoupled from the kernel release cycle.” It is the technology beneath the low-overhead flow telemetry in netflix-service-topology and networking tools like Cilium, and this page answers the spoke’s eBPF operational-cost open question. Source: official ebpf.io.
How it works
Programs attach to kernel hooks (syscalls, function entry/exit, network events, tracepoints), then:
- a verifier proves they “always run to completion” and stay in-bounds (safety);
- JIT compiles bytecode to native speed;
- maps (hashes, ring buffers) share state with userspace.
Why it matters — and what it costs
Gives “fine-grained … data at low overhead” for observability, networking, and security without kernel patches. But the operational constraints the synthesis asked about are real: needs CAP_BPF privileges, the verifier caps program size/complexity (“finite complexity”, all paths evaluated), and features depend on kernel version — the coverage eBPF buys is gated on fleet kernel currency.
Beyond observability — security & live patching (ebpf-kernel-observability-infoq)
A practitioner source (ebpf-kernel-observability-infoq, Dan Fineran/Isovalent) extends the picture past telemetry. The verifier is the “bouncer on the door” that makes untrusted in-kernel code safe; on top of that, Tetragon uses eBPF for security (process/privilege/file monitoring) with “front-foot” enforcement that hooks syscalls before kernel execution — enabling live CVE patching, not just alerting. The same source raises an AIOps frontier: AI-generated eBPF policies for automatic CVE mitigation (experimental — generated policies “often contain specification errors”). Practical takeaway: most teams consume Cilium/Tetragon abstractions rather than writing raw eBPF.
A fourth domain — scheduling (sched-ext)
Beyond observability, networking, and security, eBPF now reaches the scheduler. sched-ext (Linux v6.12) lets a custom CPU scheduler run as a verified BPF program loaded from user space — the same “program the kernel without patching it, decoupled from the release cycle” bargain applied to the kernel’s most performance-critical core. Meta’s ads fleet used it to cut p99 latency 28% and save 3.28 MW, hot-swapping the scheduler policy by restarting a process rather than reinstalling a kernel. So the “eBPF is a general kernel-programmability substrate, not just telemetry” reading is now concrete: observability + networking + security + scheduling, all on the verifier-guarded hook-and-map machinery above.
Related
observability · netflix-service-topology · service-topology · platform-ops · opentelemetry · aiops · ebpf-kernel-observability-infoq · sched-ext · meta-sched-ext-ads