5 ms·

eBPF is great but it only works for linux and access to the kernel layer doesn't work for serverless environments, so it's definitely a piece of the puzzle but

eBPF is great but it only works for linux and access to the kernel layer doesn't work for serverless environments, so it's definitely a piece of the puzzle but not a silver bullet IMO.

zasgar 6y ago
Co-founder/CEO of Pixie here. eBPF is indeed a part of the puzzle. It allows us to access telemetry data without any manual instrumentation when running on Linux machines. Pixie itself is extendable and currently ingests data from many other sources as well. Joining forces with New Relic will allow us to focus on expanding the open-source project, but also expand our capabilities by plugging into other open APIs and frameworks such as OpenTelemetry, Grafana, Prometheus.
- pstuart 6y ago
  I caught your presentation to GoSF a couple weeks ago -- it was very impressive and I'm looking forward to the opportunity to apply lessons learned from that. https://github.com/pixie-labs/pixie/tree/main/demos/simple-gotracing/trace_example https://github.com/pixie-labs/pixie/tree/main/demos/simple-g... p.s. The slides would be nice to have too :-)
  - zasgar 6y ago
    Thanks for attending the talk: Slides: https://www2.slideshare.net/ZainAsgar/no-instrumentation-golang-logging-with-ebpf-gosf-talk-111120 https://www2.slideshare.net/ZainAsgar/no-instrumentation-gol... Write up: https://blog.pixielabs.ai/ebpf-http-tracing/ https://blog.pixielabs.ai/ebpf-http-tracing/ https://blog.pixielabs.ai/ebpf-function-tracing/post/ https://blog.pixielabs.ai/ebpf-function-tracing/post/
- ed_elliott_asc 6y ago
  Hi, Why do you need the kernel support if you modify the binaries, why not insert a function to write your logs and then insert a call to that function rather than relying on kernel support via an int 3? Curious really.
  - serbrech 6y ago
    performance, plus lower level metrics that tell you about the health of the system/host, disregarding what software is running.
xiphias2 6y ago
Is there any technical reason why it couldn't work with serverless?
- yjftsjthsd-h 6y ago
  Because serverless still needs to run on a machine, and that machine is typically at least one of 1. shared with other users, in which case giving you kernel access would be a security issue, or 2. ephemeral (firecracker VM or such) in which case eBPF is... technically possible, but not nearly as useful (you go from "this server has had X events of type Y over the last 24 hours" to "this VM had X events happen in the 590ms before it was destroyed").
  - xiphias2 6y ago
    I see, I thought it could be used for some simple thing, like a load balancer / proxy with a bit of logic in it, but I guess it's too constrainted to do something useful as a server

eBPF is great but it only works for linux and access to the kernel layer doesn't work for serverless environments, so it's definitely a piece of the puzzle but not a silver bullet IMO.

zasgar 6y ago

Co-founder/CEO of Pixie here. eBPF is indeed a part of the puzzle. It allows us to access telemetry data without any manual instrumentation when running on Linux machines. Pixie itself is extendable and currently ingests data from many other sources as well. Joining forces with New Relic will allow us to focus on expanding the open-source project, but also expand our capabilities by plugging into other open APIs and frameworks such as OpenTelemetry, Grafana, Prometheus.

pstuart 6y ago
I caught your presentation to GoSF a couple weeks ago -- it was very impressive and I'm looking forward to the opportunity to apply lessons learned from that. https://github.com/pixie-labs/pixie/tree/main/demos/simple-gotracing/trace_example https://github.com/pixie-labs/pixie/tree/main/demos/simple-g... p.s. The slides would be nice to have too :-)
- zasgar 6y ago
  Thanks for attending the talk: Slides: https://www2.slideshare.net/ZainAsgar/no-instrumentation-golang-logging-with-ebpf-gosf-talk-111120 https://www2.slideshare.net/ZainAsgar/no-instrumentation-gol... Write up: https://blog.pixielabs.ai/ebpf-http-tracing/ https://blog.pixielabs.ai/ebpf-http-tracing/ https://blog.pixielabs.ai/ebpf-function-tracing/post/ https://blog.pixielabs.ai/ebpf-function-tracing/post/
ed_elliott_asc 6y ago
Hi, Why do you need the kernel support if you modify the binaries, why not insert a function to write your logs and then insert a call to that function rather than relying on kernel support via an int 3? Curious really.
- serbrech 6y ago
  performance, plus lower level metrics that tell you about the health of the system/host, disregarding what software is running.

xiphias2 6y ago

Is there any technical reason why it couldn't work with serverless?

yjftsjthsd-h 6y ago
Because serverless still needs to run on a machine, and that machine is typically at least one of 1. shared with other users, in which case giving you kernel access would be a security issue, or 2. ephemeral (firecracker VM or such) in which case eBPF is... technically possible, but not nearly as useful (you go from "this server has had X events of type Y over the last 24 hours" to "this VM had X events happen in the 590ms before it was destroyed").
- xiphias2 6y ago
  I see, I thought it could be used for some simple thing, like a load balancer / proxy with a bit of logic in it, but I guess it's too constrainted to do something useful as a server