framework
Linux kernel feature that runs sandboxed programs in kernel space, enabling fast networking, observability, and security tools without kernel changes.
No evidence-backed relationships are recorded.
Tetragon ran inside a CodeBuild GitHub Actions runner and killed /usr/bin/curl when a dependency's postinstall script tried to reach a non-loopback address. The control needs a pinned host kernel and privileged mode.
Reality
A dev.to teardown argues static IP blocklists cannot survive CGNAT and 100,000-address proxy pools, so edge defence moves to the fields a kernel writes into the first SYN: initial window, MSS, option ordering.
Reality
The eBPF side of the MIT-licensed talus-process-monitor just reports file opens; the counting, the per-PID rate window and the SIGKILL all live in a userspace loop, a perf-buffer hop after the syscall.
Reality
On a kind cluster where kube-proxy was never installed, Cilium 1.17.3 forwards Services with no KUBE-SERVICES chain at all, so the grep that returns 13 rules elsewhere returns nothing while the app stays up.
Reality
Before judging agent-written code, a dev.to author seeded a small C backup client with eight known behaviors and observed it with system-call traces, a loopback capture and a digest check to see which observer caught what.
Reality
Cilium 1.19 puts routing, mTLS and observability in one eBPF program per node, with a single Envoy per node for Layer 7. The 100 GB of RAM the post says that frees assumes 1,000 pods at the top of the sidecar range.
Reality
AWS's account of rebuilding Lambda's network flow logging explains why per-tenant iptables rules grew more expensive per packet as a worker filled up, and why the module's missing IPv6 support closed off any fix by tuning.
Reality
Both eBPF hooks install into the kernel by different routes, but the difference that bites in production is how they hand over arguments, and a kprobe hands over registers by position, trusting whatever sits in them at that moment.
Reality
Upwind's Series C more than doubles the company's price since January and funds runtime collection pulled out of the Linux kernel, but it records what five investors will underwrite rather than what cloud security buyers have already bought.
Reality
The Series C values the company at $3.8bn, double its January mark. The only number a buyer can act on is the refresh rate. A 30-second cadence only pays for itself if someone is on the other end of the diff.
Reality
The ranking arrives with no deal count and no partner roster, so the part a buyer can actually check is the plumbing under it, which is pay-as-you-go billing on an account you already own and findings normalised to OCSF.
Reality
Adyen traced sandbox setup failures on its big data clusters to a garbage collector that walks every tracked connection in order, which turns the table-size knob you raised for headroom into part of the fault.
Reality
field-cage blocks outbound connections from Linux runners in the kernel, keeps its logs on the box, and disclaims step correlation, tamper detection and organization-wide visibility.
Reality
One operator flipped Cilium to full kube-proxy replacement and woke at 2:47 AM to a SIEM ingesting zero events. The cluster was healthy. The evidence pipeline was not.
Reality
A tutorial walkthrough of kube-proxy is a useful reminder that a ClusterIP is not an interface. The iptables-to-IPVS-to-eBPF sequence is an answer to per-node rule accounting, not taste.
Reality
The integrated product shipped on July 7 and CTech later put the price near $65 million, unconfirmed by either company. The method matters more than the number.
Reality
eBPF uprobes can rebuild Go traces with no SDK in the call path. The cost moves rather than disappears: goroutine correlation, per-version register layouts, and inlined symbols.
Reality
A dev.to walkthrough traces one packet from 10.244.1.5 to 10.244.2.5. The operationally useful part is not the hop count, it is which route table or outer header you get to read.
Reality