eBPF: Connecting with Container Runtimes

https://h0x0er.github.io/blog/2025/06/29/ebpf-connecting-with-container-runtimes/

by forxtrot • 1 year ago

76 8 1 year ago

h0x0er.github.io

debatem1• 1 year ago

None of these snippets appear to involve eBPF at all?

forxtrot4• 1 year ago

Correct no eBPF-code is directly involved. As post explores eBPF-based tools for understanding user-space connection with container-runtime and enrichment of event once received from kernel-space.

desiderantes• 1 year ago

Hi, this is a nonsensical reply, as the sentence is lacking a few words to be complete. Are you using some kind of AI to answer? If so, which one?

yjftsjthsd-h• 1 year ago

As post explores eBPF-based tool

What ebpf-based tool(s)? It looks like it's just sample code to open a socket to a CRI.

tanelpoder• 1 year ago

I found this article interesting (in fact, posted it earlier, but it didn't get traction then). I think some context is needed: When you operate at eBPF/kernel level you don't get easy direct access to the higher level goodies, like various container metadata (other than perhaps the cgroup id/name). So with eBPF you extract various numbers and IDs and then use userspace code+services to retrieve the meaningful (human-readable) context and strings using these IDs.

A plain Linux example would be that eBPF will only give you user/group IDs (uid/gid), not usernames, so you need to use post-processing in userspace code to convert these IDs into something meaningful.

forxtrot4• 1 year ago

Thanks for giving the context.

eBPF: Connecting with Container Runtimes

Related Stories