Dan Fineran from Isovalent (now Cisco) explains how eBPF has evolved from its Berkeley Packet Filter roots into a safe, hot-deployable kernel extension mechanism. The eBPF verifier acts as a strict security guardrail, preventing programs from crashing the kernel or accessing invalid memory. Key use cases covered include deep observability without code instrumentation (via kprobes, uprobes, tracepoints), networking with Cilium, and security enforcement with Tetragon. Tetragon's pre-hook capability allows blocking malicious syscalls — including buffer overflows tied to CVEs — before the kernel executes them. The conversation also touches on eBPF's expanding support for Windows, the potential for AI-generated Tetragon policies enabling self-healing infrastructure, and practical advice on evaluating open-source eBPF projects in an era of AI-generated code contributions.
