DevConf.US 2021 is the 5th annual, free, Red Hat sponsored technology conference for community project and professional contributors to Free and Open Source technologies coming to Boston!
eBPF has been a part of the Linux kernel for well over six years now, and during that time it has been under constant development—but how is it being used in production? In this talk we'll take a brief tour of the history of BPF, its evolution into eBPF, and how the unique interface it provides for programming the kernel is uniquely suited for networking, security and observability. We'll look at some basic eBPF programs, discuss the various ways they can hook into the kernel, and what safety features are in place. Next, we'll look at a pair of open source projects where eBPF is being used in practice: in runtime security project Falco, where it is used to instrument the kernel in environments where a kernel module isn't feasible, and in the Kubernetes networking solution Calico, where an eBPF data plane provides improved performance and implements features like IP source address preservation and connect-time load balancing. Finally, a live demo will give attendees a glimpse of some of the tools available to them for performance monitoring and observability in the BPF Compiler Collection (BCC).
