[HN Gopher] Isolated Execution Environment for eBPF
       ___________________________________________________________________
        
       Isolated Execution Environment for eBPF
        
       Author : tuananh
       Score  : 18 points
       Date   : 2025-04-15 15:42 UTC (7 hours ago)
        
 (HTM) web link (ebpf.foundation)
 (TXT) w3m dump (ebpf.foundation)
        
       | skywhopper wrote:
       | Am I missing where this article actually proposes this "isolated
       | execution environment"? It's mentioned in the intro and summary
       | (and title), but the rest of the post is mainly a list of why
       | it's hard to do early verification of eBPF code.
       | 
       | Okay, this is true!
       | 
       | So I'm left wanting to know why the author thinks less rigid
       | "isolation" is a suitable answer to the problem. "JavaScript does
       | something similar" is the only detail I could find. But
       | JavaScript notably does not run in the kernel.
       | 
       | Ultimately this just seems like a post saying "it's too hard to
       | do everything we want within the current limitations of eBPF. But
       | makes no effort to explain why getting rid of these strictures
       | would be worth the huge security and reliability hole it would be
       | creating, or how they would avoid those issues.
        
       | westurner wrote:
       | From https://news.ycombinator.com/item?id=43553198 ..
       | https://news.ycombinator.com/item?id=43564972 :
       | 
       | > _Can_ [or should] _a microkernel run eBPF?_ [or WASM?]
       | 
       | The performance benefits of running eBPF in the kernel are
       | substantial and justifying, but how much should a kernel or a
       | microkernel do?
        
       ___________________________________________________________________
       (page generated 2025-04-15 23:02 UTC)