@pchaigno.bsky.socialLinux v7.3 is going to include a rework of the #eBPF verifier errors. Most errors will now describe:
- which specific verification rule was violated and why;
- where in the C code the error is happening;
- how the faulty state was reached;
- and how the issue could be fixed.
@adegoodyer.comA practical guide to Tetragon on Kubernetes - observing kernel events, writing TracingPolicies, alerting with Grafana and Loki, then enforcing safely.
#tetragon #ebpf #security #kubernetes #observability
https://stdout.adegoodyer.com/posts/getting-started-with-tetragon/
@frankel.wsocial.eu
@frankel.ch@pchaigno.bsky.socialLaurin Brandner implemented an HTTP parser using #eBPF! When used to build an in-kernel HTTP cache, it improves throughput by up to 3x at high incoming rates.
Slides: lpc.events/event/20/con...
Stream: youtube.com/live/UQCglEw...
Paper: arxiv.org/pdf/2605.31084
Code: github.com/lerboe/beeper
@uhltak.bsky.socialeBPF revolutioniert Linux-Observability! Code direkt im Kernel ausführen – sicher, performant und ohne Kernel-Modifikation. Perfekt für Cloud-Native Security & Monitoring. #eBPF #DevOps
@pchaigno.bsky.socialLitmus tests are small concurrent programs that expose weak memory behaviors. Ali Siddiqui and Xiaoguang Wang show how #eBPF can enforce placement and timing scheduling invariants to improve the effectiveness of litmus tests.
Video: www.youtube.com/watch?v=e1iU...
Paper: dl.acm.org/doi/pdf/10.1...
@uhltak.bsky.socialWarum alle über eBPF reden? Weil es Linux-Sicherheit und Monitoring revolutioniert! Code direkt im Kernel ausführen – sicher, performant und ohne Kernel-Module. Ein Gamechanger für Cloud-Native Security. #eBPF #Linux
@hugovalters.bsky.socialCilium Tetragon attaches eBPF to kernel tracepoints/kprobes, blocking process exec, file and network activity at the syscall boundary. TracingPolicy can log or https://www.valtersit.com/vault/ebpf-runtime-enforcement-with-tetragon-for-privilege-escalat-46f458/
#ebpf #zero-trust #ValtersIT
@o11y-jobs.bsky.social◇ Site Reliability Engineer (SRE) - Early Talent @ Nebius
Amsterdam, Netherlands
Sre in the stack. Put this near the top of the list.
https://o11y.jobs/jobs/site-reliability-engineer-sre-early-talent-nebius-085101?utm_source=bluesky&utm_medium=social&utm_campaign=jobs
#jobs #sre #ebpf #kubernetes
@uhltak.bsky.socialeBPF verändert alles! Code sicher direkt im Linux-Kernel ausführen – ohne Rekompilierung. Perfekt für ultraschnelles Networking, Security & tiefes Monitoring in Kubernetes. Tschüss, Performance-Overhead! #eBPF #Linux
@hugovalters.bsky.socialCatch container escapes early: trace sys_enter_unshare, sys_enter_setns, and sys_enter_clone with bpftrace. Log PID, flags, and target ns inode. CLONE_NEWUSER=0x10000000, https://www.valtersit.com/vault/trace-namespace-syscalls-with-bpftrace-to-detect-escape-atte-d52736/ #linux #ebpf #bpftrace
@hugovalters.bsky.socialPacket loss at 3am, tcpdump shows SYN with no SYN-ACK, and no agent installed. eBPF tools like bpftrace and tcpdrop ship in the kernel, so you can trace the drop in minutes. Guide: https://www.valtersit.com/guides/linux/ebpf-network-observability-zero-install-kernel-tools/ #eBPF #Linux #Sysadmin
@pchaigno.bsky.socialNew #eBPF ideas merged upstream sometimes take years before they are discovered, reused, and improved by the research community. I didn't want that for netkit, so I proposed writing a paper about it to Daniel. I'll present it at the eBPF workshop next week!
@uhltak.bsky.socialWarum eBPF der Gamechanger für Linux & Kubernetes ist? Es erlaubt sicheres Ausführen von Code direkt im Kernel-Space – ganz ohne Kernel-Modul. Ideal für Echtzeit-Observability und Cloud-Security mit minimalem Overhead. #Linux #eBPF
@bartoszosiej.bsky.socialThe eBPF verifier isn't a linter to appease — it's a constraint you design around. CO-RE offsets break across kernels, and the verification story has to live in CI, not in your head. #eBPF #Linux https://bartoszosiej.github.io/content/ebpf-verifier-design-constraint
@bartoszosiej.bsky.socialBehavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
@bartoszosiej.bsky.socialThe eBPF verifier isn't a linter to appease — it's a constraint you design around. CO-RE offsets break across kernels, and the verification story has to live in CI, not in your head. #eBPF #Linux https://bartoszosiej.github.io/content/ebpf-verifier-design-constraint
@bartoszosiej.bsky.socialBehavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
@bartoszosiej.bsky.socialThe eBPF verifier isn't a linter to appease — it's a constraint you design around. CO-RE offsets break across kernels, and the verification story has to live in CI, not in your head. #eBPF #Linux https://bartoszosiej.github.io/content/ebpf-verifier-design-constraint