Monitoring Containers with BPF

While containers represented a huge leap forward in how applications are built, deployed, and managed, they can also turn monitoring into a bit of a murder mystery. But hope is not lost!In this talk, …

While containers represented a huge leap forward in how applications are built, deployed, and managed, they can also turn monitoring into a bit of a murder mystery. But hope is not lost!In this talk, we will explain how you can use BPF (Berkeley Packet Filter) to peek inside the Linux network stack to understand how containers are behaving. In particular, we will show you how to navigate the different Linux subsystems such as cgroups, tasks, tcp/udp stack, and NAT with your own BPF programs to trace the voyage of connections and correlate them with container metadata from Docker or Kubernetes.Finally, we’ll show you some insights and scale considerations we found running some of these BPF programs in production clusters.