eBPF Interview Q&A
Q: What is eBPF and why is it important for DevOps?
Extended Berkeley Packet Filter: runs sandboxed programs in kernel space without kernel changes. Used for: performance observability (Cilium, Pixie), network policy enforcement, security monitoring (Falco), distributed tracing without sidecars. Replaces sidecar proxies in some scenarios.
Q: Cilium vs Istio?
Cilium uses eBPF for networking and observability — no sidecar proxies needed. Lower overhead, higher performance. Istio uses Envoy sidecars — more features (retries, circuit breaking, traffic shifting), higher resource cost. Cilium is replacing Istio in performance-critical environments.
Q: How does eBPF help with security?
Falco uses eBPF to detect runtime anomalies: unexpected syscalls, privilege escalation, suspicious file access. Real-time detection in kernel without modifying application code.
Q: How is eBPF different from kernel modules?
Kernel modules run with full kernel privileges — a bug crashes the entire system. eBPF programs are verified by the kernel verifier before loading: checks for infinite loops, memory bounds, type safety. eBPF is sandboxed — cannot crash the kernel or access arbitrary memory. Much safer to deploy in production.
Q: What is XDP in eBPF?
eXpress Data Path — eBPF hook at the network driver level, before the kernel network stack. Can process packets at line rate: drop DDoS packets before they reach the TCP stack, perform load balancing, implement firewall rules. Cilium uses XDP for high-performance Kubernetes network policies.
Q: Name three production use cases for eBPF.
Q: What is bpftrace?
High-level tracing language for eBPF. Write one-liners to trace kernel functions, syscalls, user-space applications. Example: `bpftrace -e 'kprobe:sys_read { printf("%s read %d bytes
", comm, arg2); }'` — prints process name and bytes for every read syscall. Useful for production performance investigation.