Falco and eBPF: Optimizing Large-Scale Tracing Tools

Explore the challenges and potential of Falco and eBPF in high-throughput scenarios through this conference talk. Delve into the complexities of building large-scale tracing tools, focusing on Falco's use of BPF for tracing system events. Examine the portability issues across various kernel versions and the limitations they impose on leveraging modern BPF concepts. Learn about the current BPF probe architecture, its strengths, and daily criticalities. Discover potential mitigations for existing problems and future plans for improvement, including the exploitation of modern BPF tracing features where possible. Gain insights into instrumentation and consumer issues, current mitigations, and upcoming enhancements in this technical exploration of Falco and eBPF's capabilities and limitations.