Usage of Extended Berkeley Packet Filter (eBPF) Rising with Bill Mulligan

This is Textron tv. Hey guys, thanks for the throw. We're here with Bill Mulligan, who's from the eBPF Foundation and also works on cilium as a maintainer, and of course has a job working with is since they help, uh, commercialize cilium.

So we're gonna talk about what's going on with not just cilium and networking, but more importantly the underlying technology known as eBPF, which, uh, is a subsystem that shows up in Linux that's transforming how we think about networking, storage, observability, all kinds of fun stuff. Bill, welcome to the show. Thanks for having me today.

So you guys have a new report out, at least the talking about what has the adoption of eBPF been like, where are we on this curve? And I guess my first question to you is, do you feel like we're ahead of the curve, behind the curve or right on plan? I think it's really an exciting time for EVPF right now.

So the state of the EVPF report kind of, I think, kind of summarizes what's been happening in the industry and really the last decade. You know, eeb PF is almost a decade old technology and it took so long, I guess, to kind of get into production for a lot of people 'cause it required a newer kernel. And now we're finally hitting the point where enough companies are, you know, on long term like LTS releases where Eeb PF is supported so they can start leveraging tools using eeb PF and, uh, we're really seeing an explosion of projects of products, uh, people using eeb PF right now.

And I think kind of going forwards in next couple years are gonna be really exciting for the whole ecosystem around EVPF. Do you think we're looking at a massive cycle of upgrades here? Because so many of the older products, whether they're storage, networking, security, rely on user space.

And if we can shift all that down into the kernel, they'll run faster at higher degrees of scale. So, um, should it organizations be thinking this through a little bit? Because all this stuff is gonna, uh, I guess churn may not be the best word, but we are gonna see a lot of rip and replacement, I think.

Yeah, I do think it's gonna be an interesting time for the industry. Um, I think there's kind of like two separate tracks here. Like one is existing end vendors are upgrading their products to include EVPF, uh, based features.

So we can see that in, uh, a bunch of different people. Like most recently, uh, like, uh, Cisco acquiring is valent to guide Git ahead, um, in, in the networking space with eBPF. And then we're also seeing a lot of new products come onto the market too.

So I can tell you just kind of like, like following what's happening in the industry. Uh, there's a lot of security startups, uh, that are all doing really interesting stuff with eBPF, and I think that's gonna be probably the, the biggest space, uh, going forwards for companies is how is Eeb PF going to be used in security. I think that's a whole new realm that we're just at the start of right now.

How do you think this is gonna play out? Because as far as I can tell, it's only been like the last three or four releases of Linux where we're seeing mainstream adoption of eeb PF in the distributions that people use. So is this kind of pursuing some sort of natural curve following that?

I mean, how many people are on the latest release of those Linux updates, I guess is what I'm asking? EVPF has been included. Well, it originally began in 2014.

That's what got merged into the mainline kernel, right? Um, and so it's been quite a while since then. Um, and like I was saying, it's being included by more of the major distributions and that's why people are adopting the tools right now.

Um, in terms of like the actual adoption, we're actually seeing a lot of companies already using EVPF, even though they might not already know that. So for instance, like cilium is used by hundreds of organ, like hundreds of organizations around the world that have all stated publicly, Hey, we're using cilium. It's the foundation for almost every major clouds provider managed Kubernetes offering.

Um, and so a lot of people are using eBPF even if they don't know it, and it, it comes back to, you know, they're using kernels that support eeb PF and they can use projects leveraging it. What Do it teams have to do? Do I just upgrade and happily wake up one morning and things are running faster and basically it's all transparent to me?

Or how involved do they need to be in the fact that something is using EBBF? So I think there's kind of like two different ways you can look at this. You can really dig into the Linux kernel internals or you can just leverage a product that's using eeb PF and it's really up to your company to choose which one is better for you.

In the same way some companies had their own Linux kernel teams that were, you know, kind of modifying things, um, to make it specific, uh, to their company. I, I think we're gonna see some companies doing that, developing their own eBPF program that are designed and tailored specifically to their use cases. I know like Netflix is one of the early adopters doing a lot with eBPF, and if you think about the scale that they're running at, like even a one or 2% performance improvement could be like a, a lot for them.

And with eeb PF you can get even more than that, but I think what we're probably gonna see a lot more people doing is leveraging projects or products that kind of give them eBPF off the shelf. You know, so something that they can I install and then that that product or project then manages the eeb PF programs for them. So I don't think there's gonna be, you know, like millions of people writing eBPF programs, they're gonna be going into production.

I I think a lot of people will be using it to learn and experiment, uh, to understand how the technology works. But then when we're actually going from, you know, TE testing, understanding, you know, the benefits of the technology to moving towards actually production, I, I think a lot of people are gonna use applications that do that because EVPF, I mean, it's just like writing your own Linux kernel module or trying to get something into the upstream, uh, community. It's a really complex thing.

Um, and it's, it requires deep technical expertise. Whether every company wants to invest into that is their, their own decision. But I think, you know, as we go towards more mainstream adoption, I I think a lot of people will be leveraging the products and products that give EDPF to 'EM for free.

I, I, I think this is actually a great thing because these products are going to essentially have like a better user experience, right? They're gonna have things like faster networking, better observability, more secure systems, and people can kind of get that by just using the system that's leveraging EPPF inside What's left to be done for the EPPF foundation because we got this far. I mean, and in a certain sense, maybe you could just declare victory and go home, but what else is the foundation gonna be working on?

Yeah. So I think this is kind of a really interesting time for the whole ecosystem around EVPF. I think, um, if you watch the Eeb PF documentary, uh, that that came out, uh, one of the lines that really stuck with me, uh, that, that Thomas said, uh, was we've got this into the kernel now.

Uh, we, we can rebuild everything from scratch. What should we, we rebuild first, right? And so with cilium, we started with networking and, you know, creating performance improvements, scalability improvements, making it, uh, ready for the dynamic cloud native world, right?

And so I think when we're kind of looking at this, the, the exciting thing for me about Eeb PF right now is that we're really writing, I would say like the next generation of infrastructure software and Eeb PF is gonna allow us and enabled us to do that. And so we're kind of on the precipice of what's to come next. And I think what we're doing with Eeb PF will kind of write what the next 10, maybe the next 20 years of technology is able to do.

Um, so we're providing, I think we're really in this like building blocks phase, right? Where we have eBPF as a technology and we're using eeb PF to create new building blocks on top of which we can build a new infrastructure stack that prepares us for, you know, challenges as we go towards, you know, really worldwide systems, high demand systems. Um, yeah, I think that's a really exciting time to be in the ecosystem.

We're really creating the operating system of the future in real time. To that end, I think a lot of times we take new innovations and we basically do what we have been doing faster. My next question to you is, will the ability to have this in the kernel, um, change the way we think about certain products and technologies to drive more convergence of say, networking and security or more convergence of observability and security?

I mean, are there things that we are gonna be able to do that previously we just wouldn't have imagined? Yeah, I think that's like, the fun thing about eeb PF is you can add new functionality on the fly. Like one of the examples that, um, I I like to give sometimes is like thinking about like an iPhone, right?

So previously a phone came with installed software and that's pretty much what you got. But the cool thing about the iPhone, right, is that you could add new applications, essentially new functionality on the fly to do whatever you needed to. I think that's a little bit what we're doing now as a loose analogy with EDPF, right?

We can add new functionality into the kernel to do what we wanna do in the future. And, uh, I I, I think we are seeing some of that convergence right now because if you're doing something like networking, right? If you already have the information about the network, well, it already provides you great observability about what's happening.

Um, and then from that observability of the data, you also have security to figure out when malicious actors are. And that's actually what we're doing a lot with the, with the cilium project. We have cilium for networking, Hubble verbs of mobility and TEON for security and kind of they're each, you know, slightly separate projects, but they all rely on this, uh, information, this data that eBPF gives us to create the higher level functionality.

And so we're seeing a little bit of this, uh, convergence, uh, from eBPF. You mentioned Cisco earlier. Is that the tip of the iceberg?

Are we gonna see a lot of mergers and acquisitions revolving around this whole space? Because a lot of the folks who delivered previous generations of products that relied on user space are gonna look for ways to jumpstart their way into eBPF. Yeah, I think, I wouldn't say we're gonna see a lot of mergers or acquisitions in the next year.

Um, I, I think this is the fun time where we're kind of seeing the Cambrian explosion of technology. We, of companies of different products coming to the market and like the acquisitions and the, the mergers come down the line from that. And I'm actually tracking all the acquisitions and we've kind of had like a, a different series of ones over the years, but I, I think it's, we're not gonna see them for another couple years that 'cause the companies and the techno and the products are really being built right now.

Um, so I'm seeing a lot of companies and projects based around EVPF coming onto the market right now. And then as they mature, they become really good, uh, targets for acquisition Ultimately. What's your best advice then to folks about if they're not going down the path already, how to get started or even discover the fact that they may already be down the path and not realize it?

Yeah, so there's a couple great resources that I'd recommend people to check out. io is a community resource that explains what the technology is, what it does, gives you different case studies and other places to jump off. If you wanna kind of understand like how the technology came to be and like how it's starting to shape the industry.

I'd also recommend the Eeb PF documentary. Um, 'cause it tells like the backstory and a really compelling i i, I think fun way. Um, and you can also find that on the Eeb PF website too.

All right folks, you heard it here. It is a brave new world and a lot of times the thing that has the biggest impact is invisible to you. So take a moment, figure out what all those new versions of Linux are running and how come maybe things are running better than you ever imagined.

'cause it might have something to do with this eBPF thing that hardly anybody knows much about. Hey Bill, thanks for being on the show. Yeah, thanks for having me Back to you guys in the studio.