Microkernels once promised modularity, minimalism, and isolation. But they often fell short on performance and developer experience. eBPF flips that model.
Instead of pulling functionality into userspace, it makes the monolithic kernel dynamic. It allows behavior to be defined at runtime through loadable, auditable programs, letting infrastructure teams shape systems from inside the kernel, without patching or forking. eBPF is not just a new programming model, it’s a new way to think about what an operating system is and who gets to shape it.
In the Software Engineering Daily podcast, ByteDance engineers share how they’re applying this philosophy at massive scale. As part of the “second wave” of hyperscalers, they were able to learn from the architectures of Google and Meta and then build their own stack around eBPF from day one. That decision let them move past iptables to per-core connection tracking, build reliable load balancers with strong internal SLOs, and customize datapath behavior while keeping a clean upstream kernel.
eCHO news is your bi-weekly wrap up of all things eBPF and Cilium. If you want to keep up on the latest in cloud native networking, observability, and security this is your quelle
15th July 2025
Microkernels once promised modularity, minimalism, and isolation. But they often fell short on performance and developer experience. eBPF flips that model.
Instead of pulling functionality into userspace, it makes the monolithic kernel dynamic. It allows behavior to be defined at runtime through loadable, auditable programs, letting infrastructure teams shape systems from inside the kernel, without patching or forking. eBPF is not just a new programming model, it’s a new way to think about what an operating system is and who gets to shape it.
In the Software Engineering Daily podcast, ByteDance engineers share how they’re applying this philosophy at massive scale. As part of the “second wave” of hyperscalers, they were able to learn from the architectures of Google and Meta and then build their own stack around eBPF from day one. That decision let them move past iptables to per-core connection tracking, build reliable load balancers with strong internal SLOs, and customize datapath behavior while keeping a clean upstream kernel.
eBPF might not be a microkernel, but it's bringing us closer to the modular, trustworthy systems architecture that microkernels aspired to. Built not by replacing Linux but instead by making it programmable from the inside out. I've got to go reprogram my legs for a few upcoming bikepacking races so let’s 🐝 -gin.
eCHO Episode 187: Exploring Cluster API Provider microVM (CAPMVM) with Cilium
Upcoming Stream
eCHO Episode 188: OOM and eBPF
The Post of the Week
As always, if you’ve seen a blog post, a tool, or anything else eBPF or Cilium related that you think the rest of the community should hear about, send them my way. You can either hit reply or join the #echo-news channel on Cilium Slack. You can also find all of the past episodes on the website.
🐝
To make sure you keep getting these emails, please add bill@isovalent.com to your address book or otherwise mark me as a permitted sender.
Know a friend that needs to be in the know? Forward this to them
Written and sent by Bill Mulligan. Any feedback is welcome!
I work for Isovalent at Cisco which is leading the eBPF-Powered Revolution in Cloud Native Networking, Observability, and Security with Cilium and Tetragon
Cisco/Isovalent, LLC, 755 Sycamore Drive, Milipitas, CA 95035, United States
.jpg?upscale=true&width=142&upscale=true&name=KC%2BCNC_NA_Headshot_241114_William_Mulligan_8154%20(1).jpg)
