Microsoft, Facebook, Google and Netflix are collaborating on eBPF Foundation

Four major tech giants have announced that they will be working together on the eBPF Foundation. With the collaboration, Microsoft, Facebook, Google and Netflix hope to improve eBPF faster. The eBPF Foundation will become part of the Linux Foundation.

The announcement comes just before the eBPF summit, which takes place on August 18 and 19. EBPF already works in the Linux kernel, but in May Microsoft announced it was starting an open source project to get eBPF working on Windows 10 and Windows Server 2016 and newer. Now Google, Facebook and Netflix are also interested in further developing the tool.

EBPF stands for extended Berkeley Packet Filter. It was originally intended for analyzing network traffic through low-level packet interception. Much more is now possible with eBPF via virtual machines, both at the kernel level and in the user space.

This allows users to run sandboxed programs in the kernel of an OS, among other things. It is therefore used to safely and efficiently extend such a kernel, without having to change the kernel source code or load kernel modules. EBPF enables developers to securely and efficiently embed programs in any software, including the operating system kernel.

The tech companies that form the eBPF Foundation already use the packet filter. Facebook, for example, uses the tool as a load balancer in its data centers. “EBPF is a revolutionary technology that allows us to modify an operating system in real time without risky or costly changes to the kernel’s code,” writes Alexei Starovoitov, a kernel developer at Facebook. Google uses Cilium in turn to provide eBPF-based networking and security on its Kubernetes offering with GKE and Anthos.

The use cases of eBPF. Image through eBPF