How GitHub uses eBPF to improve deployment safety
Did you know that, at GitHub, we host all of our own source code on github.com? We do this because we’re our own biggest customer—testing out changes internally before they go to users. However, there’s one downside: If github.com were ever to go down, we wouldn’t be able to access our own source code. This is what you’d call a very simple circular dependency: to deploy GitHub, we needed GitHub. I
作ã£ã¦ã‚ã‹ã‚‹OpenTelemetryã®ã‚¼ãƒã‚³ãƒ¼ãƒ‰è¨ˆè£… Go言語eBPFç·¨ - Mackerel ブãƒã‚° #mackerelio
OpenTelemetryã§ã¯eBPFã¨ã„ã†æŠ€è¡“を用ã„ã‚‹ã“ã¨ã§ã€Go言語ã§ã§ããŸã‚¢ãƒ—リケーションã®ã‚³ãƒ¼ãƒ‰ã‚’変更ã›ãšã«è¦³æ¸¬å¯èƒ½ã«ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚本記事ã§ã¯ã€ãã®æ‰‹æ³•ã¨ä»•çµ„ã¿ã«ã¤ã„ã¦å®Ÿéš›ã«ã‚³ãƒ¼ãƒ‰ã‚’書ããªãŒã‚‰è§£èª¬ã—ã¾ã™ã€‚ ã“ã‚“ã«ã¡ã¯ã€‚Mackerelãƒãƒ¼ãƒ ã§ã‚¢ãƒ«ãƒã‚¤ãƒˆã‚’ã—ã¦ã„るエンジニア㮠id:appare45 ã§ã™ã€‚本記事ã§ã¯OpenTelemetryã®ã‚¼ãƒã‚³ãƒ¼ãƒ‰è¨ˆè£…ã‚’ã€Go言語ã§ã§ããŸã‚¢ãƒ—リケーションã«å¯¾ã—ã¦eBPFを用ã„ã¦å®Ÿç¾ã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦ã€å®Ÿéš›ã«å®Ÿè£…ã—ãªãŒã‚‰è§£èª¬ã—ã¦ã„ãã¾ã™ã€‚ ゼãƒã‚³ãƒ¼ãƒ‰è¨ˆè£…ã¨ã¯ eBPFã¨ã¯ Go言語ã§eBPFプãƒã‚°ãƒ©ãƒ を書ã 関数ã®å®Ÿè¡Œé–‹å§‹ã¨çµ‚了を記録ã™ã‚‹ uretprobeを使ã‚ãšã«é–¢æ•°ã®çµ‚了を知る Goroutineを追ㆠMackerelã¸ãƒˆãƒ¬ãƒ¼ã‚¹ã‚’投稿ã™ã‚‹ 引数ã®å€¤ã‚’å–å¾—ã™ã‚‹ eBPFを用ã„ãŸGo言語ã®ã‚¼ãƒã‚³ãƒ¼ãƒ‰è¨ˆè£…ã®ã¾ã¨ã‚ Appendix: 環境構
eBPFã¨waruiBPF
kernel/vm探検隊@北陸 part8ã®ãƒ—レゼン資料ã§ã™ã€‚ https://kernelvm.connpass.com/event/367760/
GitHub - qpoint-io/qtap: Qtap: An eBPF agent that captures pre-encrypted network traffic, providing rich context about egress connections and their originating processes.
An eBPF agent that captures traffic flowing through the Linux kernel. By attaching to TLS/SSL functions, data is intercepted before and after encryption and then passed to flexible plugins with full visibility along with all of the available context - process/container/host/user/protocol/etc. Qtap makes it possible to understand what's happening with your egress traffic, without modifying apps, in
Code coverage for eBPF programs
I bet we all have heard so much about eBPF in recent years. Data shows that eBPF is quickly becoming the first choice for implementing tracing and security applications, and Elastic is also working relentlessly on supercharging our security solutions (and more) with eBPF. However, one major challenge is that the eBPF ecosystem lacks tooling to make developers' lives easier. eBPF programs are writt
Linuxカーãƒãƒ«ã®eBPFã«è¤‡æ•°ã®æ·±åˆ»ãªè„†å¼±æ€§ã€€PoC公開済ã¿ã®ãŸã‚è¦æ³¨æ„
「Linuxカーãƒãƒ«ã€ã®eBPF（Extended Berkeley Packet Filter）ã«è¤‡æ•°ã®è„†å¼±ï¼ˆãœã„ã˜ã‚ƒã）性ãŒå˜åœ¨ã™ã‚‹ã“ã¨ãŒåˆ†ã‹ã£ãŸã€‚ã“れらãŒæ‚ªç”¨ã•ã‚ŒãŸå ´åˆã€Linuxカーãƒãƒ«å†…ã§ä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã‚„DoS攻撃ãŒå¼•ãèµ·ã“ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚る。 eBPFã¯Linuxカーãƒãƒ«å†…ã§å®‰å…¨ã‹ã¤é«˜åŠ¹çŽ‡ã«ã‚«ã‚¹ã‚¿ãƒ コードを実行ã§ãる仕組ã¿ã§ã€ã‚«ãƒ¼ãƒãƒ«ã®æŒ¯ã‚‹èˆžã„ã‚’å‹•çš„ã«å¤‰æ›´ã€æ‹¡å¼µã™ã‚‹ãŸã‚ã®ãƒ—ラットフォームã¨ã—ã¦æ©Ÿèƒ½ã—ã¦ã„る。もã¨ã‚‚ã¨ãƒ‘ケットフィルタリングã®ãŸã‚ã«é–‹ç™ºã•ã‚ŒãŸãŒã€ç¾åœ¨ã§ã¯ãƒˆãƒ¬ãƒ¼ã‚¹ã‚„監視ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯åˆ¶å¾¡ã€ã‚»ã‚ュリティãªã©å¹…広ã„用途ã«åˆ©ç”¨ã•ã‚Œã¦ã„る。eBPFプãƒã‚°ãƒ©ãƒ ã¯ã‚«ãƒ¼ãƒãƒ«å†…ã®ç‰¹å®šã®ã‚¤ãƒ™ãƒ³ãƒˆï¼ˆã‚·ã‚¹ãƒ†ãƒ コールã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ‘ケット処ç†ã€ã‚¹ã‚±ã‚¸ãƒ¥ãƒ¼ãƒ©ãªã©ï¼‰ã«ãƒ•ãƒƒã‚¯ã§ãã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚¹ãƒšãƒ¼ã‚¹ã‹ã‚‰ãƒãƒ¼ãƒ‰ã•ã‚Œã‚‹ã€‚ Linuxカーãƒãƒ«ã®eBPFã«è¤‡æ•°ã®è„†å¼±æ€§ã€€PoC公開済ã¿ã®ãŸã‚急ãŽå¯¾å‡¦ã‚’ 脆弱
Netflixã¯ãƒ‘フォーマンスã®æ”¹å–„ã®ãŸã‚ã«ã©ã®ã‚ˆã†ã«Linuxã®ã‚«ãƒ¼ãƒãƒ«ã‚’æ‹¡å¼µã™ã‚‹ä»•çµ„ã¿ã€ŒeBPFã€ã‚’利用ã—ã¦ã„ã‚‹ã®ã‹ï¼Ÿ
Netflixã®æŠ€è¡“ブãƒã‚°ã«ã€Linuxã®ã‚«ãƒ¼ãƒãƒ«æ©Ÿèƒ½ã‚’æ‹¡å¼µã§ãる「eBPFã€ã‚’活用ã—ã¦ãƒ‘フォーマンスを改善ã™ã‚‹æ–¹æ³•ãŒæŠ•ç¨¿ã•ã‚Œã¾ã—ãŸã€‚ Noisy Neighbor Detection with eBPF | by Netflix Technology Blog | Sep, 2024 | Netflix TechBlog https://netflixtechblog.com/noisy-neighbor-detection-with-ebpf-64b1f4b3bbdd Netflixã®ã‚³ãƒ³ãƒ”ューティング・パフォーマンスエンジニアリングãƒãƒ¼ãƒ ã¯ã€å®šæœŸçš„ã«ãƒžãƒ«ãƒãƒ†ãƒŠãƒ³ãƒˆç’°å¢ƒã«ãŠã‘るパフォーマンスã®å•é¡Œã‚’調査ã—ã¦ã„ã¾ã™ã€‚å•é¡ŒãŒç™ºç”Ÿã—ãŸã¨ãã€èª¿æŸ»ã®æœ€åˆã®ã‚¹ãƒ†ãƒƒãƒ—ã¯åŽŸå› ãŒã‚¢ãƒ—リケーションã«ã‚ã‚‹ã®ã‹åŸºç›¤ã¨ãªã‚‹ã‚¤ãƒ³ãƒ•ãƒ©ã‚¹ãƒˆãƒ©ã‚¯ãƒãƒ£ã«ã‚ã‚‹ã®ã‹ã‚’切り分ã‘ã‚‹ã“ã¨ã§ã™ã€‚ Netflixã®ã‚µãƒ¼ãƒ“スを支ãˆã‚‹ãƒ—ラ
eBPFã®ã“ã‚Œã¾ã§ã¨ã“ã‚Œã‹ã‚‰
æƒ…å ±ç§‘å¦è‹¥æ‰‹ã®ä¼š2024
Trayce
Features Offline only - HTTP requests are stored in local files using the .bru format Manage collections and folders to organize your requests Variables to re-use values Environment variables to switch between different environments Securely store secret variables in a .env file How does container monitoring work? The TrayceAgent container runs along side your existing containers. The agent uses e
eBPFã«å…¥é–€ã—ã¦ç°¡å˜ãªã‚·ã‚¹ãƒ†ãƒ コールãƒã‚¬ãƒ¼ã‚’実装ã—㟠- zebian.log
ã‚»ã‚ュã‚ャン2023ã§SysmonForLinuxを使ã£ãŸçµŒé¨“ãŒã‚ã‚Šã€ãƒ—ãƒã‚°ãƒ©ãƒ ã®æŒ™å‹•ãƒã‚°ã‚’自作ãƒã‚¬ãƒ¼ã§å–ã‚ŠãŸã„ãªã¨æ€ã£ãŸã®ã§ã€Go+ebpf-goã§ç°¡å˜ãªã‚·ã‚¹ãƒ†ãƒ コールãƒã‚¬ãƒ¼ã‚’実装ã—ãŸã€‚eBPFã‚‚Goã‚‚åˆå¿ƒè€…ãªã®ã§ã‚³ãƒ¼ãƒ‰ãŒæ±šã„ã®ã¯å¾¡æ„›å¬Œã€‚ コード全体 コードã¯ã“ã“ã«æ›¸ã„ãŸã€‚記事作æˆæ™‚点ã®ã‚³ãƒ¼ãƒ‰ã§ã‚ã£ã¦ã€æœ€æ–°ç‰ˆã§ã¯ãªã„ã®ã§æ³¨æ„。 main.go package main import ( "bytes" _ "embed" "encoding/binary" "encoding/json" "fmt" "os" "os/signal" "syscall" "github.com/cilium/ebpf" "github.com/cilium/ebpf/link" "github.com/cilium/ebpf/ringbuf" "github.com/cilium/ebpf/rlimit"
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
HyperMesh | Build It Right
GitHub - parca-dev/oomprof: eBPF OOM Memory Profiler
XDPã«ã‚ˆã‚‹ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚·ã‚™ã‚§ãƒãƒ¬ãƒ¼ã‚¿ã®è©± - eBPF Meetup Japan #4 | ドクセル
Rootless ãªç’°å¢ƒã«ãŠã‘ã‚‹ eBPF ã®æ´»ç”¨
S’initier à eBPF avec Aya (Partie 1)
GitHub - aquasecurity/traceeshark: Deep Linux runtime visibility meets Wireshark
CVE-2024-56614 & CVE-2024-56615: PoC Exploits Released for Severe eBPF Vulnerabilities in Linux Kernel
PHPアプリケーションã«ãŠã‘ã‚‹eBPFã®ä½¿ã„所
Bring your Linux Threat-Hunting capabilities to the next level | Kunai
GitHub - mmcshane/salp: USDT probes in Golang on Linux
{{#tags}}- {{label}}
{{/tags}}