»Anatomy of Cloud Native eBPF Instrumentation«
2019-11-17, 09:45–10:15, Room2

In this talk the audience will take a deep dive into understanding eBPF in the Linux kernel. The audience will learn how eBPF is used in the Falco’s custom kernel instrumentation for Kubernetes. They will also see how eBPF has enabled us to rewrite the Falco core engine data collection infrastructure using a set of eBPF programs. This talk shows you how you can use eBPF for your use case.

Join us as we live code a simple eBPF program that will pull all kernel syscall information in the same way that Falco does. We create a lightweight “strace-like” program using eBPF. The audience walks away understanding how easy it is to implement an eBPF program for an arbitrary use case.