Ebpf

The second instalment chronicling Cloudflare's journey with eBPF, looking at why standard Linux networking APIs couldn't support Cloudflare's requirements, and what the team built to fill those gaps.

Chronicling Cloudflare's eight-year journey with eBPF, starting with the move from hardware to the eBPF ecosystem

What eBPF hooks, kernel reads, maps, rings, and arenas actually cost, measured across cores.

Guest Post: While many L7 protocols are complex to parse, the logic needed to enforce L7 policies tends to be simple. For the vast majority (89%) of L7 policies in the wild, Beeline can eliminate the service proxy from the critical path.

When writing our eBPF code, my brother and I wanted our policies to be extremely fast and space efficient, and we also wanted processes to inherit policies (while still being fast and space efficient). This blog post explains what we did to make our eBPF

A practical guide to building, inspecting, cross-compiling, and running Linux eBPF/XDP applications on macOS using Colima, Docker, Clang, bpf2go, and Go.

Docker Sandboxes and microVM isolation keep AI agents away from the host. They do not tell security teams what the agent read, ran, changed, or sent while it was inside.

Abstract page for arXiv paper 2607.23900: KernelScript: Cross-Boundary Typed DSL for eBPF Applications

When testing our eBPF agent, I don't always get the same experience as our users, especially in performance critical sections. I realize that the benchmark test suite isn't always enough, because user's environments can be completely different from our be

How we built line-rate network observability for untrusted CI jobs without touching the guest.