A Tale of Two eBPFs: Towards eBPF Management Frameworks for the Rest of US

The current eBPF ecosystem caters for the dominant open-source use-cases: i.e., debugging (observability) and network functions (e.g., Firewalls and cloud networking). However, there is a growing set of use cases within the enterprise and hyperscaler domains that remain unaddressed. As a consequence, eBPF programs in these programs are susceptible to significant performance and availability issues as evidenced from Datadog's recent outages.

In this talk, I will provide a brief overview of these emerging use cases and challenges that they introduce.  Then I will discuss ongoing work to use a synthesis of program language, machine learning, and system designs to them. The central theme to this work is that the existing BPF-management heuristics do not generalize and yet BPF is fundamentally tied to the kernel.  We introduce mechanisms to decouple BPF management primitives from the kernel's heuristics and propose mechanisms to modularize and support BPF code mobility.  I will conclude by describing an ongoing open. source community that we are building around these tools.