2 ms·
After looking at the link first, this comment cracked me up. I skimmed most of the GH content without figuring out the answer; I wasn't going to click an O'Reil
by noduerme 4y ago
After looking at the link first, this comment cracked me up. I skimmed most of the GH content without figuring out the answer; I wasn't going to click an O'Reilly link. So I gave up. Then my OCD kicked in and I got annoyed with myself for giving up, since if I'm going to waste time on HN I should really get to the bottom of things. So searched it. I found this:
https://ebpf.io/what-is-ebpf/ https://ebpf.io/what-is-ebpf/
It runs sandboxed kernel extensions? Or it's a VM? Something like that? The writing of the page itself doesn't inspire a lot of confidence, but then maybe it's just over my head.
- Dylan16807 4y ago> It runs sandboxed kernel extensions? Or it's a VM? Yes to both of those. The kernel has a bunch of extension points that can run eBPF code in a VM. That code can make decisions for the kernel and/or track events. eBPF code can do basically any calculation you want, but it can't have infinite loops. It's loaded as bytecode, with a spec for how it's formatted and what the instructions do and what data structures are built in to the VM. The main benefit is that it runs in the kernel, so it can be triggered very very often with minimal performance impact.