eBPF Foundation received a $228,000 grant from Alpha-Omega to strengthen the security of the ecosystem 🐝

Highlights eBPF-code covered by verifier

Observability isn't a tool you buy anymore, rather it's a property of the platform you build. If I had to summarize 2025 in a sentence, it would be that observability finally matured from a data business into a systems problem again.

High-Performance XDP Firewall & Traffic Analyzer written in Rust

Every server at Meta runs eBPF, 50% over 180 programs and they run on average across 20 different kernel versions I think we will see more and more companies heading this way so check out this talk to see how they needed to re engineer their CI/CD pipeline www.youtube.com/watch?v=wXuy...

Minimal gulp agent to collect traces from eBPF

A lightweight eBPF daemon that counts outbound TCP and UDP events per process and exports them as Prometheus metrics

Year 10 of Cilium and its been the best one yet. Read all about it in the Annual Report

eBPF-based tool for monitoring and visualizing Goroutine events in realtime with a beautiful web UI

My alma mater uses Cilium 🐄 I wonder if these clusters help with ice cream production 🍦 "Cilium has been phenomenal. We started with core networking, added Hubble for observability, Cluster Mesh for cross-cluster communication, and are exploring Tetragon"

Security hardening tool designed to detect and break the post-exploit kill chain for containerized applications, leveraging BPF LSM

SCX_MUS, or Mostly Unfair Scheduler, is a custom Linux scheduler built with the sched_ext framework to optimize container prioritization in Kubernetes for improved performance

eBPF dev room schedule for FOSDEM 2026 is out 🐝 eBPF has become a normalized building block for infrastructure so if you want a single room that spans kernel internals, language tooling, observability, and networking, I'll see you in Brussels over a beer 🍻 fosdem.org/2026/schedul...

Monitor ARP, TCP, UDP, ICMP, DNS, HTTP, and TLS traffic at the kernel level using eBPF

Happy 10th Birthday, Cilium! 🎂 One decade ago, Thomas Graf pushed an initial commit with just a LICENSE, a .gitignore, and 226 lines of code. There was no Hubble, no Cluster Mesh, no network policy, no Tetragon, and eBPF still had a logo with a pea pod in it.

At #LinuxPlumbers, @breakawaybilly.bsky.social presented what the eBPF Foundation is doing, where its funds are going, and asked the attendees what should be next. Recording: www.youtube.com/live/ZLRngpd... Slides: lpc.events/event/19/con...

Interactive graphical thread and scheduling analysis tool using eBPF

Ecosystems emerge from code and community coordination. My presentation at Linux Plumbers Conference walked through how eBPF Foundation is building the scaffolding that makes innovation repeatable.

XDP Virtual Server - an eBPF load balancer implementation and supporting Go library

A high-performance network traffic generation tool that leverages XDP

I'm at Linux Plumbers Conference in Tokyo this week to talk about what the eBPF Foundation accomplished this year and get feedback from the community on what we should focus on next If you can't make, let me know what you think is currently holding eBPF back so the foundation can work to fix it 🐝

Excited to be in Tokyo for Linux Plumbers Conference. Shung-Hsi Yu already has a summary of what to look forward to on day 1. What do you think is the most interesting? shungh.si/blog/lpc-202...

Userspace library for chaining co-located AF_XDP network applications

Advent of code? How about advent of eBee? 🐝 Brush up on your @cilium.io skills over the holidays 🎄

Lightweight system for profiling XDP applications using kfuncs

"The infrastructure equivalent of dark matter" 🐝 I love this take on eBPF from @rawkode.dev This is also exactly why Cilium has become the default. The future of Kubernetes networking is eBPF-powered. It's not even a debate. It's just physics 😉 rawkode.academy/technology/m...

eBPF-powered Linux observability with AI incident detection

Results from the Cilium User Survey are in and it shows how we are moving from plumbing to platform. The networking conversation has moved from connectivity to topology where cluster mesh and network policy are what truly turns Cilium into a platform.

A nostalgic terminal Snake game powered by eBPF 🐝

LFX Mentorships is one of my favorite parts of working with CNCF

A method of defending against SLOW GET, POST, & READ attacks implemented through eBPF using CO-RE and libbpf

10,000 raw events ➡️ 1 useful alert turns eBPF from a firehose into a funnel If you try to ship every kernel event to userspace, you are killing the system rather than observing it. You need In-Kernel Filtering, Ring Buffers and User-Space Windowing

"eBPF is becoming the strategic platform of choice for infrastructure teams" This line from latest eBPF Foundation report written by Andrew Green is going to be doing a lot of work in the next decade. ebpf.foundation/new-state-of...

DNS filtering with eBPF

A High-Performance XDP/eBPF Packet Broker for Flow-Based Distribution of VXLAN-Encapsulated Traffic for Network Analysis

eBPF-based troubleshooting tool for Kubernetes applications

100,000 CPU cores handling 10 million requests per second while reducing infrastructure costs by 19% and worker hangs by 99.8%. Alibaba leverages eBPF with a userspace-directed I/O event notification framework for L7 load balancing.

Cilium has been on the keynote stage in end user architectures for the last 4 KubeCon's in a row because it has become the baseline in cloud native. When all major cloud providers and distros make a technology their default, it stops being "cutting edge" and starts being "infrastructure."

Will I see anyone there tonight? '

Last few days left for the eBPF Summit Hackathon. This is your chance to showcase what you have been building with eBPF 🐝 ebpf-summit-2025.devpost.com

My last time as co-chair for CiliumCon 🥲 www.credly.com/badges/f22b7...

An eBPF-based DDoS mitigator specifically designed for IoT devices

Using eBPF for security, Datadog was dealing with 10 billion file-related events per minute, but they were able to reduce that by 94% by implementing in-kernel filtering based on rules pushed from user space into eBPF maps. This is scalable eBPF architecture

Customer kernel to use in Apple Container with eBPF support

ingress-nginx is going to the datacenter in the sky ☠️ Luckily, Dean has a migration guide to Cilium's Ingress or Gateway API implementation using ingress2gateway

18 KubeCons since Copenhagen 2018 🇩🇰 A lifetime in tech, but looking at these shirts, it almost feels like nothing has changed.

One week left for the eBPF Dev Room CfP at FOSDEM 🐝

"Networking is the elephant in the server room. It’s clear that Kubernetes networking is having a moment" Kate Holterhoff nails my impression from KubeCon exactly

A Kubernetes operator that logs and forwards all HTTP requests over TCP/IPv4 using an eBPF program to intercept traffic

eBPF hosting routing is not GA in Azure CNI powered by Cilium getting users throughput jumps of ~30% for same-node traffic, up to 3x for tiny messages across nodes, and reduces latency by 27%.