Microsoft, Facebook, Google and Netflix collaborate on eBPF Foundation

Four major tech giants announce their collaboration on the eBPF Foundation. With the collaboration, Microsoft, Facebook, Google and Netflix hope to improve eBPF faster. The eBPF Foundation becomes part of the Linux Foundation.

The announcement comes just before the eBPF summit, which will take place on August 18 and 19. EBPF already works in the Linux kernel, but in May Microsoft announced that it was starting an open source project to get eBPF working on Windows 10 and Windows Server 2016 and newer. Now Google, Facebook and Netflix are also interested in developing the tool further.

EBPF stands for extended Berkeley Packet Filter. It was originally intended for analyzing network traffic by low-level packet interception. Much more is now possible with eBPF via virtual machines, both at the kernel level and in the user space.

It allows users to run sandboxed programs in the kernel of an OS, among other things. It is thus used to safely and efficiently extend such a kernel, without having to change the kernel source code or load kernel modules. “EBPF enables developers to securely and efficiently embed programs into any software, including the operating system kernel,” the Linux Foundation writes in its announcement.

The tech companies that make up the eBPF Foundation already use the packet filter. Facebook, for example, uses the tool as a load balancer in its data centers. “EBPF is a revolutionary technology that allows us to modify an operating system in real time without risky or costly changes to the kernel code,” writes Alexei Starovoitov, a kernel developer at Facebook. Google, in turn, uses Cilium to provide eBPG-based networking and security on its Kubernetes offerings with GKE and Anthos.

The use cases of eBPF. Image via eBPF