eBPF for observability
Kernel-level tracing. This post digs into the topic, drawing on recent discussion from Hacker News, Reddit, and the wider community.
The conversation that prompted this post is linked in the sources. I have tried to capture the substance of the discussion rather than just summarize it, because the comments are usually where the real insight lives.
What happened
Observability at the kernel level is the final frontier. Once user-space metrics lie, only the kernel tells the truth.
Performance tuning is measurement-driven. Guessing is how you make things slower.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
Observability at the kernel level is the final frontier. Once user-space metrics lie, only the kernel tells the truth.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
Performance tuning is measurement-driven. Guessing is how you make things slower.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
Performance tuning is measurement-driven. Guessing is how you make things slower.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
Why it matters
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
The kernel's stability guarantee is its superpower. User space can change freely because the kernel will not break you.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
Performance tuning is measurement-driven. Guessing is how you make things slower.
The kernel's stability guarantee is its superpower. User space can change freely because the kernel will not break you.
Namespaces are the isolation primitive behind containers. Understanding them demystifies Docker and Kubernetes.
Namespaces are the isolation primitive behind containers. Understanding them demystifies Docker and Kubernetes.
Practical takeaways
- Namespaces are the isolation primitive behind containers.
- Performance tuning is measurement-driven.
- io_uring is the biggest change to Linux I/O in a generation.
- The Linux kernel is the most successful open source project in history, and it is still evolving.
- io_uring is the biggest change to Linux I/O in a generation.
- Filesystem choice matters more than people think.
- Namespaces are the isolation primitive behind containers.
- io_uring is the biggest change to Linux I/O in a generation.
- Observability at the kernel level is the final frontier.
- Observability at the kernel level is the final frontier.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
Performance tuning is measurement-driven. Guessing is how you make things slower.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
Performance tuning is measurement-driven. Guessing is how you make things slower.
Performance tuning is measurement-driven. Guessing is how you make things slower.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
Namespaces are the isolation primitive behind containers. Understanding them demystifies Docker and Kubernetes.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
Observability at the kernel level is the final frontier. Once user-space metrics lie, only the kernel tells the truth.
Namespaces are the isolation primitive behind containers. Understanding them demystifies Docker and Kubernetes.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
Performance tuning is measurement-driven. Guessing is how you make things slower.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
The kernel's stability guarantee is its superpower. User space can change freely because the kernel will not break you.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
Sources
This post is informed by discussion on ebpf.io and related threads on Hacker News and Reddit. Primary source: https://ebpf.io/.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
The kernel's stability guarantee is its superpower. User space can change freely because the kernel will not break you.
Performance tuning is measurement-driven. Guessing is how you make things slower.
Observability at the kernel level is the final frontier. Once user-space metrics lie, only the kernel tells the truth.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
Performance tuning is measurement-driven. Guessing is how you make things slower.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
The kernel's stability guarantee is its superpower. User space can change freely because the kernel will not break you.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
Namespaces are the isolation primitive behind containers. Understanding them demystifies Docker and Kubernetes.
The kernel's stability guarantee is its superpower. User space can change freely because the kernel will not break you.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
Observability at the kernel level is the final frontier. Once user-space metrics lie, only the kernel tells the truth.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
Namespaces are the isolation primitive behind containers. Understanding them demystifies Docker and Kubernetes.
Namespaces are the isolation primitive behind containers. Understanding them demystifies Docker and Kubernetes.
Filesystem choice matters more than people think. ext4, xfs, and btrfs have different performance characteristics and failure modes.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
Observability at the kernel level is the final frontier. Once user-space metrics lie, only the kernel tells the truth.
The kernel's stability guarantee is its superpower. User space can change freely because the kernel will not break you.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
cgroups v2 unified the resource control interface. If you run containers, you are using it whether you know it or not.
Namespaces are the isolation primitive behind containers. Understanding them demystifies Docker and Kubernetes.
Performance tuning is measurement-driven. Guessing is how you make things slower.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
The Linux kernel is the most successful open source project in history, and it is still evolving. Rust in the kernel is the most significant language change in decades.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
The kernel's stability guarantee is its superpower. User space can change freely because the kernel will not break you.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
systemd is controversial and ubiquitous. Understanding it is table stakes for Linux operations.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
eBPF lets you run sandboxed programs in the kernel without changing kernel source. It is the foundation of modern observability and security tooling.
Performance tuning is measurement-driven. Guessing is how you make things slower.
io_uring is the biggest change to Linux I/O in a generation. It replaces the syscall-per-operation model with batched, async submission.
Observability at the kernel level is the final frontier. Once user-space metrics lie, only the kernel tells the truth.