Well, the article is from 2008. Nowadays, Smart NICs can handle encryption and IOMMU provides (some) security isolation. The sendfile() syscall uses these if

Well, the article is from 2008. Nowadays, Smart NICs can handle encryption and IOMMU provides (some) security isolation. The sendfile() syscall uses these if available. (https://people.kernel.org/kuba/tls-1-3-rx-improvements-in-linux-5-20 https://people.kernel.org/kuba/tls-1-3-rx-improvements-in-li...) I never used Kafka. I'd expect that using Cloud HSM for TLS/SSL offloads in any cloud should get you zero copy with encryption.