Engineer for the future of Cloud
June 10-13, 2019
San Jose, CA

eBPF-powered distributed Kubernetes performance analysis

Lorenzo Fontana (Sysdig)
11:35am12:15pm Wednesday, June 12, 2019



Prerequisite knowledge

  • Basic understanding of containers, Kubernetes, and distributed architectures


Since the Linux kernel 4.x series, a lot of enhancements have reached the mainline of the eBPF ecosystem, giving us the capability to do a lot more than just network stuff. Lorenzo Fontana provides an initial understanding of what eBPF programs are and how to hook them to programs running inside Kubernetes clusters in order to answer targeted questions at cluster level but about very specific, fine-grained situations: Has that function in my program been called? For a given function, which arguments have been passed to it? What it did return? Which TCP packets are being retransmitted? Which queries are running slow? What are the insights on programming language events/GC? Has that file been opened?

Photo of Lorenzo Fontana

Lorenzo Fontana


Lorenzo Fontana is an open source software engineer at Sysdig where he primarily works on Falco, a Cloud Native Computing Foundation (CNCF) project that does container runtime security and anomaly detection. He’s passionate about distributed systems, software-defined networking, the Linux kernel, and performance analysis. He’s the maintainer of the IO Visor’s project kubectl-trace.

Leave a Comment or Question

Help us make this conference the best it can be for you. Have questions you'd like this speaker to address? Suggestions for issues that deserve extra attention? Feedback that you'd like to share with the speaker and other attendees?

Join the conversation here (requires login)