[HN Gopher] eBPF: Connecting with Container Runtimes
       ___________________________________________________________________
        
       eBPF: Connecting with Container Runtimes
        
       Author : forxtrot
       Score  : 68 points
       Date   : 2025-07-10 19:10 UTC (1 days ago)
        
 (HTM) web link (h0x0er.github.io)
 (TXT) w3m dump (h0x0er.github.io)
        
       | debatem1 wrote:
       | None of these snippets appear to involve eBPF at all?
        
         | forxtrot wrote:
         | Correct no eBPF-code is directly involved. As post explores
         | eBPF-based tools for understanding user-space connection with
         | container-runtime and enrichment of event once received from
         | kernel-space.
        
           | desiderantes wrote:
           | Hi, this is a nonsensical reply, as the sentence is lacking a
           | few words to be complete. Are you using some kind of AI to
           | answer? If so, which one?
        
             | forxtrot wrote:
             | No A.I, just H.I (Human Intelligence) :).
        
           | yjftsjthsd-h wrote:
           | > As post explores eBPF-based tool
           | 
           |  _What_ ebpf-based tool(s)? It looks like it 's just sample
           | code to open a socket to a CRI.
        
             | forxtrot wrote:
             | The snippets are taken from cilium/tetragon,
             | aquasecurity/tracee and crictl as mentioned in the post.
             | 
             | The post doesn't covers these projects in depth, instead
             | act as a quick reference to the parts, where connection
             | with CRI is being made and used for enrichment.
             | 
             | I understand there are more better ways to do the thing.
             | 
             | P.S: Post is a collection of my memories, when I was
             | implementing the functionality. So just wanted to share, in
             | hope that, maybe it will help others as well. Thanks !
        
       | tanelpoder wrote:
       | I found this article interesting (in fact, posted it earlier, but
       | it didn't get traction then). I think some context is needed:
       | When you operate at eBPF/kernel level you don't get easy direct
       | access to the higher level goodies, like various container
       | metadata (other than perhaps the cgroup id/name). So with eBPF
       | you extract various numbers and IDs and then use userspace
       | code+services to retrieve the meaningful (human-readable) context
       | and strings using these IDs.
       | 
       | A plain Linux example would be that eBPF will only give you
       | user/group IDs (uid/gid), not usernames, so you need to use post-
       | processing in userspace code to convert these IDs into something
       | meaningful.
        
         | forxtrot wrote:
         | Thanks for giving the context.
        
       ___________________________________________________________________
       (page generated 2025-07-11 23:02 UTC)