Hacker News Reader

There was also a more recent one on eBPF and Kubernetes which was an interesting read: https://thenewstack.io/ebpf-put-the-kubernetes-data-plane-in...

What do people think about this way to explain eBPF:

Microkernels were presented as the future in which fewer things would run in the kernel. Instead we've gone in the other direction in which more is running inside the kernel.

Monolithic kernel: the Network Device runs inside the kernel and the Packet Filter outside.

Microkernel: both the Network Device and Packet Filter run outside the kernel.

eBPF: both the Network Device and the Packet Filter run inside the kernel.

Yep, that seems pretty spot on. Not sure yet how I feel about allowing sandboxed user code in the kernel (my gut doesn't like the idea) but much smarter people than me seem to think it makes sense so I guess time will tell.

Another good way to get started is https://ebpf.io/. It features pointers that go beyond just networking and also cover usage of use cases involving tracing, profiling, security, ...