Falco and eBPF: Optimizing Large-Scale Tracing Tools

Explore the challenges and potential of Falco and eBPF in high-throughput scenarios through this conference talk. Delve into the complexities of building large-scale tracing tools, focusing on Falco's use of BPF for tracing system events. Examine the portability issues across various kernel versions and the limitations they impose on leveraging modern BPF concepts. Learn about the current BPF probe architecture, its strengths, and daily criticalities. Discover potential mitigations for existing problems and future plans for improvement, including the exploitation of modern BPF tracing features where possible. Gain insights into instrumentation and consumer issues, current mitigations, and upcoming enhancements in this technical exploration of Falco and eBPF's capabilities and limitations.

Intro
Falco: a peculiar eBPF use case
How instrumentation works?
Consumer issue
Current mitigations
Instrumentation issue
Future enhancements
The portability issue