The article explains how Android’s shift to Linux kernel 4.x/5.x introduced the eBPF framework, detailing its advantages over iptables, the programming model with helper macros and maps, and its implementation in netd and HAL to collect network statistics, enforce traffic control, and support power‑saving Doze policies.
bpftrace is a Linux eBPF‑based tracing tool that compiles scripts to BPF bytecode, offering kernel and user‑space probes; the guide covers its purpose, installation on major distros and Docker, and demonstrates built‑in example scripts for command logging, I/O latency, disk size, CPU usage, and TCP connection tracing.
This article examines how eBPF and WebAssembly are reshaping service mesh data planes by offering sidecar‑less architectures, discussing their benefits, challenges, and the ongoing debate among vendors about performance, security, and programmability.
During 2021, the service‑mesh ecosystem—centered on Istio—matured with performance optimizations, protocol extensions, diverse deployment models, eBPF integration, and a growing community of tutorials, conferences, and open‑source projects, solidifying its role as essential cloud‑native networking infrastructure.
The article reviews the 2021 Kubernetes ecosystem, covering three major releases, new memory management, security enhancements, scalability features, usability improvements, the rise of Cilium Service Mesh and serverless projects, and forecasts 2022 trends toward security and eBPF adoption.
Baidu’s mixed‑workload approach co‑locates offline batch jobs with latency‑sensitive online services on shared nodes, using a dynamic resource view, priority‑based scheduling, cpuset/NUMA isolation, eBPF policies, and predictive profiling, boosting CPU utilization above 40 % and saving billions of RMB in total cost of ownership.
XDP (eXpress Data Path) is a Linux kernel eBPF hook that enables ultra‑fast packet processing at the driver level, offering multiple action codes, three deployment modes, and advantages over DPDK such as lower CPU usage, security, and seamless integration with existing networking tools.
This article analyzes Baidu's offline mixed‑tenant technology that combines online and offline workloads on the same physical servers, detailing the resource‑usage problems, dynamic resource views, priority schemes, isolation mechanisms, high‑performance scheduling, and future directions for cloud‑native clusters.
Cilium 1.11 introduces a beta Service Mesh, Kubernetes Ingress support, OpenTelemetry integration, topology‑aware load balancing, BGP pod‑CIDR announcements, managed IPv4/IPv6 neighbor discovery, XDP multi‑device acceleration, graceful termination, scalable ID spaces, endpoint slices and several feature enhancements and deprecations.
The article outlines a systematic SOP‑driven approach for diagnosing online service alarms and performance issues in Go, detailing a toolbox that includes pprof, trace, goroutine visualizers, perf and eBPF, and recommends application‑level optimizations, system tuning, and continuous profiling to accelerate root‑cause identification and reduce incident frequency.
This article explores the evolution of BPF from its origins as a packet‑filtering mechanism to the modern eBPF engine, detailing its architecture, security and performance benefits, core features such as hooks, maps and helper functions, and real‑world cloud‑native use cases like Cilium, Falco and kubectl‑trace.
This roundup highlights the launch of the PHP Foundation to boost the language’s bus factor, the Rust moderation team’s resignation protest, Amazon Linux 2022 preview, the CNCF‑sandboxed OpenELB project, and a multi‑part eBPF series for developers.
This article delves into the eBPF virtual machine's architecture, detailing its register set, instruction classes, kernel helper invocation, and step‑by‑step analysis of sample bytecode that counts network packets, providing a solid foundation for advanced eBPF tooling.
This article walks through the high‑level components of eBPF programs—backend, loader, frontend, and data structures—showing how the original sock_example.c is split into separate files, how LLVM compiles restricted C to ELF, and how projects like BCC, BPFtrace, and IOVisor automate development, deployment, and cloud‑native observability while highlighting their trade‑offs for embedded environments.
This article introduces eBPF as a register‑based virtual machine inside the Linux kernel, explains its non‑Turing‑complete design, shows how programs are loaded, verified, and attached to events, and provides a complete C example that counts TCP, UDP, and ICMP packets on a loopback interface.
This article reviews the OSDI20 best paper on hXDP, explaining why combining XDP with FPGA NICs can alleviate CPU bottlenecks, describing the challenges of eBPF offload to low‑frequency FPGA, and summarizing the custom instruction‑set optimizations and test results that achieve comparable performance to multi‑GHz CPUs.
The article explores recent shifts in the operating‑system landscape—including the CentOS 8 end‑of‑life, the rise of dual‑kernel Anolis OS, and the surge of eBPF—highlighting how cloud‑native demands are reshaping Linux development, security, and community governance.
This article introduces Cilium, the eBPF‑based Kubernetes CNI that replaces kube‑proxy, explains its security and scalability advantages over traditional iptables, and provides step‑by‑step guidance for deploying Cilium, testing its connectivity, and using Hubble for deep network visualization integrated with Grafana and Prometheus.
This article walks through installing Cilium as a CNI on a Kubernetes v1.21.3 cluster, disabling kube-proxy, and verifying network connectivity with an Nginx deployment, providing commands, configuration details, and validation steps for a kube‑proxy‑free setup.
A roundup of recent developments—from China's strict regulations on connected‑vehicle data storage and mandatory cybersecurity officers, to Baidu and ByteDance's massive campus hiring drives, Alibaba's leadership reshuffle, Lenovo's earnings surge, the formation of the eBPF Foundation, and Linux 5.15's added support for Qualcomm Adreno GPUs—highlights how policy, talent, and open‑source innovations are shaping the tech landscape.
This article explains how eBPF evolved from classic packet filtering to a powerful, programmable kernel virtual machine that enables high‑performance networking, hardware offload, and flexible security, making it increasingly vital for operators, system administrators, and enterprise solution providers.
This article introduces the fundamentals of BPF and its extended version eBPF, explains their kernel‑resident virtual machine architecture, demonstrates simple packet‑filtering examples, outlines the eBPF program lifecycle, describes key BPF system‑call commands, and surveys the various eBPF map types used for efficient data handling in Linux.
This article explains how to build a high‑performance, 5K‑node hybrid‑cloud container network by reviewing Kubernetes pod and service networking, comparing iptables, IPVS and eBPF implementations, and describing large‑scale overlay, BGP, IPVlan, and NodeLocal DNS solutions.
This article provides a comprehensive analysis of the Linux kernel's handling of localhost network I/O, detailing how packets destined for 127.0.0.1 bypass physical network interfaces, traverse the routing table, and utilize the loopback virtual device and soft interrupts for efficient intra-machine communication.
The 2021 Container Network Technology Conference celebrated Kube-OVN’s anniversary, showcasing its mature multi‑tenant, cross‑cluster, and hardware‑accelerated networking features, outlining a roadmap focused on performance, eBPF‑based security and monitoring, and highlighting real‑world deployments with partners such as Intel, F5, banks and telecom operators.
This article explains the origins and evolution of BPF into eBPF, compares it with classic kernel modules, describes eBPF tracing mechanisms, and shows how eBPF can be leveraged to secure container runtimes against escape and other cloud‑native threats.
This article explains how UCloud's Serverless container product Cube integrates Virtual Kubelet with Kubernetes, why kube-proxy is unsuitable for lightweight serverless VMs, and how an eBPF‑based Rust proxy (cproxy) provides efficient service discovery and superior performance across different service scales.
This article explains how Linux tracing tools such as kprobes, uprobes, tracepoints, eBPF, perf, ftrace, sysdig, SystemTap and LTTng fit together, describing their data sources, collection mechanisms and front‑ends, and offers guidance on choosing the right tool for low‑overhead debugging and performance analysis.
This article explains why detailed system operation logs are essential for security audits and troubleshooting, outlines filtering guidelines to avoid noisy data, and compares five Linux auditing methods—history, custom bash, snoopy, auditd, and eBPF—highlighting their strengths, limitations, and practical configuration examples.
The article explains eBPF’s evolution from packet filtering to a C‑compiled, sandboxed kernel framework, describes its core concepts of bytecode, JIT, and maps, and walks through building, loading, and using an Android eBPF program that counts system calls per PID via tracepoint hooks.
This article explains why detailed Linux system operation auditing is essential for security and troubleshooting, outlines practical filtering rules to avoid redundant or sensitive logs, and compares five auditing approaches—history, custom bash, snoopy, auditd, and eBPF—detailing their strengths, limitations, and configuration examples.
This tutorial explains how to create a Python‑based eBPF tool using the bcc framework to trace MySQL Group Replication's apply_data_packet function, covering environment setup, BPF program writing, attaching probes, and displaying real‑time thread and timestamp information.
Auditing Linux system operations is essential for security and troubleshooting, but excessive logs can overwhelm analysis; this guide outlines common filtering rules and compares five recording methods—history, custom bash, snoopy, auditd, and eBPF—highlighting their advantages, limitations, and practical configuration examples.
This article explains Kubernetes' core networking model, details the various Service types (PodIP, HostPort, NodePort, ExternalIP, LoadBalancer, ClusterIP), describes Cilium's eBPF/XDP implementation for high‑performance load balancing, and presents performance benchmarks and recent BPF kernel extensions.
Auditing Linux system operations can be streamlined by applying filtering rules to exclude noisy cron and daemon logs, avoiding sensitive command exposure, and choosing appropriate recording methods—such as history, custom bash, snoopy, auditd, or eBPF—each with distinct advantages, limitations, and configuration examples.
This article explains why detailed system operation logs are essential for security audits and troubleshooting, outlines practical filtering guidelines, and compares five Linux auditing methods—history, custom bash, snoopy, auditd, and eBPF—highlighting their strengths, limitations, and usage examples.
This article describes Ctrip's adoption of Cilium with BGP to build a high‑performance, eBPF‑based cloud‑native network, covering the evolution from Neutron+OVS, the BGP peering model, traffic forwarding paths, L4 load‑balancing, security policy implementation, and multi‑cluster integration using ClusterMesh.
This tutorial walks through creating a multi‑node KIND Kubernetes cluster, disabling the default CNI, installing Cilium 1.8.2 via Helm with Hubble enabled, demonstrating eBPF‑based network security and observability, deploying a test application, and verifying CiliumNetworkPolicy effects.
This article explains the fundamentals of cloud native computing, introduces service mesh architectures such as Istio and Envoy, explores chaos engineering with Chaos Mesh, and details how eBPF/XDP‑based user‑space container networking can accelerate data‑plane performance in modern microservice environments.
This article examines the limitations of traditional L4 load balancers like LVS and explains how modern software solutions—leveraging DPDK, VPP, XDP/eBPF, and consistent‑hash algorithms such as Google Maglev and Facebook Katran—can achieve high‑throughput, scalable, and highly available L4 load balancing in data‑center environments.
This article examines the limitations of traditional Kubernetes Service implementations, introduces Tencent TKE’s IPVS‑BPF mode that bypasses nf_conntrack using eBPF for SNAT, details its design and implementation steps, and presents extensive performance measurements showing significant latency and throughput improvements.
This article reviews the SIG Cloud‑Provider‑Alibaba webinar, explains Kubernetes container networking fundamentals, details Alibaba Cloud's high‑performance CNI implementation using Terway with exclusive and shared ENI modes, and shows how eBPF, AutoPath DNS and resource‑pooling improve scalability and latency.
This article introduces BPF/eBPF fundamentals, explains the bcc toolkit, provides installation steps for Ubuntu and CentOS, and demonstrates how to use bcc's dbstat and dbslower utilities to trace MySQL query latency and slow queries on Linux systems.
This talk explains how to diagnose MySQL performance issues by combining traditional MySQL slow‑query analysis with system‑level observation tools, introducing eBPF, bcc scripts, and practical examples to pinpoint bottlenecks across the database, OS, and hardware layers.
This article provides a comprehensive guide to Linux performance monitoring, covering essential tools such as vmstat, iostat, dstat, iotop, pidstat, top/htop, netstat, ps, strace, perf, and advanced tracing utilities, with usage examples and interpretation of their output.
