Cloudflare architecture and how BPF eats the world

Author here.

For one - read the article! BPF was originally used purely for tcpdump, but has been re-used since then. Nowadays it's used in surprising number of Linux subsystems.

eBPF allows us to do things previously impossible - you can execute untrusted code in the context of ring 0 kernel. This allows for:

- exposing details of high-bandwidth stuff, like packets

- advanced actions - XDP allows for packet forwarding or dropping, not only filtering and sending to userspace; TCP-BPF enables tuning finely-grained tcp performance details.

These things fundamentally can't be exposed to userspace in easy way (or would be very hard to implement right). Userspace program can always not-respond,be de-scheduled, while eBPF program will have a response ready very quick.

eBPF can be run in critical places of the kernel. This allows for very powerful use cases.

"Packet Filters" is a bit of a misnomer; as I understand it, it originally started out as a way to write complex firewall rules but the ability to safely run arbitrary code in the kernel has proven so useful that other Linux subsystems are gradually adding eBPF support as well. For example, you can now write a BPF program to filter what system calls a process can execute.

Some examples: https://github.com/iovisor/bcc/tree/master/tools