> We replaced the listener with an eBPF program that watches port 8125 at the traffic control layer of every interface, and a JavaScript decoder that turns the lines into Prometheus families.

this is insane! Why on earth would one to replace a short, simple, highly debugable program with this crazy combination. Why would you trade a simple socket(2) call which shows up in ss, netstat, strace etc.. with something that opaque? Especially given the bandwidth is minuscule and the destination is already localhost.