The State of eBPF - 2024


原文可以通过:https://www.linuxfoundation.org/hubfs/eBPF/The_State_of_eBPF.pdf 下载。
相关讨论:https://lwn.net/Articles/960036/
No doubt, eBPF will become the new layer in the new cloud native infrastructure stack, impacting the observability, performance, reliability, networking, and security of all applications, supporters say. Platform engineers will cobble together eBPF-powered infrastructure building blocks to create platforms that developers then deploy software on, adding business logic to the mix, and replacing aging Linux kernel internals that cannot keep up with today’s digital and, increasingly, cloud native world.
(eBPF的拥护者认为)毫无疑问,eBPF 将成为新的云原生基础设施堆栈中的新的一层,影响所有应用的可观测性、性能、可靠性、网络和安全性。平台工程师将 eBPF 能力融入到基础设施中以创建平台,然后开发人员可以在其上部署软件,添加业务逻辑,并替换无法跟上当今数字化和日益云原生化世界中老化的 Linux 内核(发展太慢)。
没有 BPF(就慢慢等吧):

有了 BPF:

The Big Use Cases: Observability, Networking, Security
For more than five years, eBPF has been operating on millions of devices and servers worldwide. Most people are already impacted by what companies do with it—and they probably don’t know it. Many of the US hyperscalers—Meta, Google, Netflix–use eBPF in production. Every Android phone uses eBPF to monitor traffic. Every single packet that goes in and out of a Meta datacenter is touched by eBPF. Companies in a myriad of industries, including software, cloud services, financial services, telco, media and entertainment, ecommerce, consulting, and security, are increasingly using eBPF technology to do more, faster, saving time and money and increasing performance. Here’s a breakdown of the three major use cases, so far, for eBPF in production:
Observability
For many companies, the arena of observability is where eBPF first took off and has had its biggest impact. Graf compares observability in computing to trying to clean a room with the lights off. Turn on the lights and the cleaning goes much faster with better results.
eBPF observability tools turn on the lights.
“For people who are not kernel developers, the Linux kernel is like a black box,” Høiland-Jørgensen says. “eBPF opens that black box and allows you to gain information on how the system is working that you couldn’t get before.”
With greater observability in distributed systems that might involve tens, hundreds, or thousands of servers, companies can more easily and fully know where the system is spending its time, where the bottlenecks are occurring, how fast the CPUs, or central processing units that run the kernel and the applications, are working, where they’re spinning cycles, and to find, more quickly, what piece of code may be malfunctioning. If a company deploys a huge cluster of servers, numbering hundreds or thousands, and something goes wrong, it can take days, weeks, or even months to figure out what is causing the problem.
...
(文字内容建议大家看 PDF 版本)
图片预览版:


















到顶部