Netflix: BPF is a new type of software we use to run Linux apps securely in the kernel
Summary
Theres growing interest in a new type of software for Linux machines called BPF, which allows the user to run a program in the kernel and enjoy "observability super powers", according to Brendan Gregg, a senior performance architect at Netflix. Facebook software engineer Alexei Starovoitov is credited with creating Extended BPF, which is now used in Android for collecting statistics from the kernel, monitoring, or debugging. And it lets him create abstract but cool, performance-related tools like his BPF theremin, which he used to figure out and visualize things like Wi-Fi signal strength. Gregg said hes been using BPF at Netflix to understand why software is blocking performance in ways that it couldnt see before in production systems. "This allows you to write kernel mode applications that can access resources and run with high performance and efficiency with guarantees of security," he said.