Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Foreword

The most important change in Linux networking in the last decade did not happen in a new protocol, a new syscall, or a new NIC feature. It happened in a tiny register machine that lives inside the kernel, has no loops you can abuse, and is allowed to touch kernel memory only through a list of approved functions. That machine is the extended Berkeley Packet Filter - eBPF - and it turned the kernel from a black box into a programmable platform.

Before eBPF, the options for a network engineer were stark. You could ship packets through the kernel’s fixed pipeline and hope the performance was good enough. You could reach for kernel modules, and take on kernel crash bugs, out-of-tree drift, and a maintainer community that rightly treats every new module as a liability. Or you could bypass the kernel entirely with DPDK and friends, and give up the kernel’s protection model, its TCP stack, and its tooling. eBPF broke that trilemma: programs that run inside the kernel at packet rate, that the verifier proves safe before they ever execute, and that you can load, update, and unload from userspace without a reboot.

The second half of the story is Rust. eBPF is a small, memory-unsafe C-like language with a strict verifier; the discipline the verifier demands - no unbounded loops, no out-of-bounds access, no leaked references - is exactly the discipline Rust’s type system enforces at compile time. The Aya project lets you write eBPF programs in Rust, compile them with a modified LLVM back end, and load them with a safe, idiomatic Rust userspace library. For the first time, the whole stack - the program that runs in the kernel and the userspace control plane that feeds it maps - can be written in one language, by one engineer, in one repository.

Why This Book Exists

There are excellent references on eBPF, and excellent references on Rust, and excellent references on Kubernetes networking. This book is about the place where all three meet: the kernel data plane of modern cloud infrastructure. Cilium - the most successful eBPF project in production - replaced iptables-based kube-proxy with eBPF load balancers, replaced userspace proxies with in-kernel socket redirects, and built a service mesh whose data path is a set of eBPF programs written (in increasing amounts) in Rust. Facebook, Google, Netflix, and the major clouds run eBPF in their routers, their DDoS filters, their security agents, and their container runtimes. If you write software that moves packets, eBPF is your platform.

Facts alone will not get you there. This book builds a model: the packet path from the NIC to your socket, the eBPF virtual machine and its verifier, the map contract between kernel and userspace, the socket layer, the Kubernetes service model, and the Cilium architecture - each layer defined before it is used, each claim accompanied by reasoning, each line of code commented, each idea drawn. The same discipline the C++ systems book applies to memory, this book applies to packets.

What You Will Build

Every chapter builds toward one project: a service-mesh data path in Rust with eBPF. The capstone wires together the pieces the earlier chapters taught you to trust: an XDP load balancer that steers packets by a hash, sockmap programs that redirect connections between pod replicas without touching userspace, and a Hubble-style observability pipeline that ships packet events out of the kernel through a BPF ring buffer. You will run it in a local kind cluster with Cilium installed, watch the same packets from two viewpoints - kernel and userspace - and finish with a system you could extend into a production load balancer or an ingress controller.

You will not build a toy. You will build the same structures the cloud providers ship, using the same disciplines: verifier-friendly program shapes, map layouts chosen for the access pattern, error paths that are logged not swallowed, and reproducible benchmarks.

Who This Book Is For

You should read this book if:

  • You are a software engineer working at the networking layer - building load balancers, proxies, gateways, security agents, or anything that touches packets or sockets - and you want to move from “it goes through the kernel somehow” to a first-principles model.
  • You know Rust and want to write systems programs that run inside the kernel, and you want to do it without C and without kernel modules.
  • You run or build Kubernetes networking - CNIs, service meshes, network policies - and you want to understand what Cilium actually does in the data path instead of treating it as a black box.
  • You are preparing for a systems or networking interview at a cloud provider, a networking company, or anywhere the questions involve packet paths, sockets, and kernel data structures.
  • You ship software whose performance budget is measured in packets per second and whose correctness budget is zero.

You do not need to have written eBPF before, but you do need to be willing to sit with the verifier and with the Linux source tree. This book does not hand-wave either one. Every term is defined when it first appears; every helper is described before it is used; every number comes with the reasoning behind it.

The Structure

The book is organised into six parts:

Part I - Foundations (Chapters 1-3) builds the model: the Linux packet path from the NIC to your socket, the eBPF virtual machine and its safety model, and the Aya toolchain that brings it all to Rust. Everything else is an application of these three chapters.

Part II - eBPF Programs, Maps & the Data Path (Chapters 4-6) is the hands-on core: the map contract between kernel and userspace, the XDP hook at line rate, and the traffic control hooks on the other side of the stack.

Part III - Protocols, Sockets & the Kernel Data Plane (Chapters 7-9) goes deep on the protocol layer: TCP/IP and the receive path, sockmap and SK_MSG redirect in the socket layer, and cgroup hooks for filtering and resource control.

Part IV - Kubernetes Networking & Cilium (Chapters 10-12) moves to the cloud: the Kubernetes networking model and CNI, Cilium’s eBPF data plane that replaces kube-proxy, and the service mesh, security policies, and Hubble observability built on top.

Part V - Production Systems Engineering (Chapters 13-15) covers what it takes to ship: performance engineering and profiling, testing and debugging against the verifier, and the security model - and attack surface - of eBPF itself.

Part VI - The Capstone (Chapter 16) closes the loop: a complete service-mesh data path in Rust, running against a real cluster, using every tool from the previous five parts.

A Note on Platforms

eBPF programs run in the Linux kernel, so the code in this book requires Linux with a recent kernel (5.15+ for everything we use; 6.x preferred) and CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_DEBUG_INFO_BTF, and the XDP and sockmap subsystems enabled. Everything else - the Aya userspace side, the maps, the tests - is ordinary Rust. If you are on macOS or Windows, the easiest path is a Linux VM or a cloud instance; the book tells you what to check and how to verify each prerequisite. The capstone additionally needs kind or a small Kubernetes cluster.

The machine this book assumes as its running example is a modern Linux x86-64 server (a 2-3 GHz Xeon or EPYC, 64-byte cache lines, a 25-100 Gb/s NIC with RSS) running a 6.x kernel. The numbers differ between generations, but the structure - and the reasoning - does not.

Welcome. Let’s build the model, and then let’s build the data path.