lines masked in circle
purple circle at half opacity

Liz Rice: Following the ‘Superpower’ Promise of eBPF

grid of red dots
white dots in concentric circle

Share This Post

Editor’s note: We were honored to have Liz presenting “Using eBPF for High-Performance Networking in Cilium” at P99 CONF 2022, which has now concluded. This article was first published in The New Stack.


For lots of folks in software engineering, every now and again a technology comes along that really sparks the imagination. I’m sure that many readers will recall their first encounters with containers, very possibly through Docker, and the realization that this was a technology that could change everything. Containerization is arguably the lynchpin of the move to cloud native.

But every step forward creates new challenges, and new boundaries to push. For me, eBPF is another transformational technology and one that I’m excited to be deeply involved in as part of the leadership team at eBPF pioneers, Isovalent.

eBPF stands for “extended Berkeley Packet Filter,” but that’s not a tremendously useful phrase for describing the scope and potential of this technology. It allows you to run custom code in the kernel in response to practically any event — the arrival of a network packet, a syscall, the invocation of a function in userspace or in the kernel… the list is practically endless. Brendan Greggs from Netflix coined the phrase “superpowers for Linux,” and that’s no exaggeration.

In my role as chair of the Cloud Native Computing Foundation’s Technical Oversight Committee, I had the very privileged opportunity to hear a lot about cloud native adoption, technologies, and challenges, across the spectrum of different projects and at different levels of the stacks. Running Kubernetes in production has become a mainstream activity these days.

But as users scale their environments and roll out business-critical cloud native apps, they’re becoming aware of new challenges. How do they scale connectivity, troubleshoot issues, and ensure security across what is increasingly a shared service for the enterprise?

Many of today’s solutions for these challenges use a sidecar model to gain awareness of individual workloads. This is a model that works, but it comes with costs. Userspace networking stacks add overhead, as can observability and security functionality that’s replicated in every pod, and we’ve seen that as a result up to 50% CPU utilization can end up being used by the infrastructure, rather than the business applications!

Additionally, security events that span multiple workloads can’t be detected from within a sidecar or firewall but are visible to the Linux kernel. eBPF opens up the potential for high-performance networking, observability, and security solutions, by directly leveraging the Linux kernel and its awareness of everything that’s happening across a host. You can have the technical and process advantages of cloud native, independent microservices for business applications, while making the infrastructure that they run on both workload- and system-aware.

There are some fantastic cloud native projects leveraging eBPF already. The CNCF’s Falco project has support for an eBPF-based driver to detect security rule violations. My former team at Aqua is developing Tracee, which combines an eBPF event-detection engine with rules defined in Open Policy Agent’s rego language. But the most widely deployed eBPF project in production is Cilium, the eBPF-based Kubernetes networking plugin.

I recall first becoming aware of Cilium at DockerCon back in 2017, through Isovalent Chief Technology Editor Thomas Graf’s Star Wars-based demo. At the time, eBPF was a pretty new Linux kernel feature available — too new to find in many enterprise deployments, but I’ve been intrigued by its possibilities ever since seeing Graf’s talk.

Fast forward to today, and the kernel features that Cilium relies on are now widely available. This availability is why I featured eBPF appears as one of the hot technologies to watch in my KubeCon keynote “Predictions from the TOC” (below), and why startups in the space — including Isovalent — are currently enjoying a ton of attention from investors and acquiring companies right now.


Graf and Isovalent CEO Dan Wendlandt have assembled many of the world’s top eBPF experts to work on the Cilium project, and it’s undoubtedly the leading networking solution in this space. I’ve been seeing big customer after big customer adopting Cilium, and at past eBPF Summits (2021, 2020), Datadog, Capital One, Adobe, and many others spoke about how the project is enabling them to overcome so many of their greatest challenges to growing their Kubernetes environments. The high-performance networking it delivers, coupled with tools for troubleshooting connectivity issues and detecting security events, are only possible through the use of eBPF, and using Cilium gives teams the confidence to deploy sensitive workloads on their Kubernetes platform.

Using eBPF for High-Performance Networking in Cilium

At P99 CONF 2022, I’ll be presenting “Using eBPF for High-Performance Networking in Cilium.” This talk uses eBPF code and demos to explore the basics of how Cilium makes network connections, and manipulates packets so that they can avoid traversing the kernel’s built-in networking stack. You’ll learn how eBPF enables high-performance networking as well as deep network observability and security. I hope to see you there!


About Liz Rice

Liz Rice is Chief Open Source Officer with eBPF specialists Isovalent, creators of the Cilium cloud native networking, security and observability project. She was Chair of the CNCF's Technical Oversight Committee in 2019-2022, and Co-Chair of KubeCon + CloudNativeCon in 2018. She is also the author of Container Security, published by O'Reilly. She has a wealth of software development, team, and product management experience from working on network protocols and distributed systems, and in digital technology sectors such as VOD, music, and VoIP. When not writing code, or talking about it, Liz loves riding bikes in places with better weather than her native London, competing in virtual races on Zwift, and making music under the pseudonym Insider Nine.

More To Explore

Bun, Tokio, Turso Creators on Rust vs Zig

What transpired when Glauber Costa (Turso co-founder), Jarred Sumner (developer of Bun.js and CEO of Oven) and Carl Lerche (developer of Tokio and major Rust

P99 CONF OCT. 18 + 19, 2023

Register for Your Free Ticket