[eCHO News] Episode #93: Cilium on microVMs. eBPF at Ant Group

eCHO news is your bi-weekly wrap up of all things eBPF and Cilium. If you want to keep up on the latest in cloud native networking, observability, and security this is your quelle

21st October 2025

I'm working on a new project for the eBPF Foundation, mapping out all the companies building in the eBPF space. If you work at one or know someone who does, I'd love to chat! In the course of my research, I also found two more acquisitions that I missed previously in the security space.

Runtime security is an emerging market that is clearly converging around eBPF. I haven't seen a single vendor going against this strategic shift. Finally, if you have read this far, I have one free cert for the Cilium Certified Associate. Whoever responds first can have it. I have a call with another eBPF company so let’s 🐝 -gin.

The Technical

The Dwarves Beneath the Kernel: Forging BTF for eBPF

Deep dive into the DWARF debug information format

Service Boundaries: The Cilium Way

"Cilium is turning your network policies into application-aware security"

Bootstrapping Rancher’s RKE2 Kubernetes Cluster on a Podman VM with Cilium CNI and MetalLB LoadBalancer

"is a powerful way to experiment with Kubernetes in a lightweight environment"

Reducing EKS cross-AZ cost using Cilium

for both cost efficiency and application performance

LinkPro: eBPF rootkit analysis

Details of eBPF hiding on an already compromised EKS cluster

Gthulhu/mcp

Turn natural-language scheduling intents into concrete scheduling strategies

yz4230/bpflog

Tiny Go library and example that logs messages from an eBPF program

mercadoalex/earthworm

Monitor the heartbeat signals of Kubernetes clusters using eBPF

PacketStream-LLC/ouroboros

Manage and chain multiple eBPF programs together, simplify program flows

LordPrinz/dzajtcper

Real-time TCP CWND monitoring and analysis toolkit using eBPF

nocturo/spale

eBPF Single Packet Authentication with HPKE sender-auth

mirzahilmi/http_rater

HTTP packet rate counter w/ eBPF

h2337/ghostscan

Unmask hidden rootkits, eBPF tricks, and ghost processes in one fast sweep

cyrozap/usbtop-ebpf

A top-like tool for monitoring USB traffic using eBPF

cache-ext/cache_ext

Framework to customize Linux page cache eviction policies using BPF

🐝

The Ecosystem

Ant Group Secures Their Platform with Kata Containers and eBPF for Fine Grained Control

eBPF was chosen because it....

Cilium User Survey

Last chance - complete it by October 23

eBPF Agents Explained for Non-Developers

Learn the difference between a good eBPF agent and a bad one

🐝

The How To

eBPF the Hard Way!

Build production-ready eBPF tools from scratch, understanding every line of code

From Zero to Your First eBPF Program

In browser eBPF tutorials from the creator of eBPFChirp

Cluster API: Azure Managed K8s with Cilium Pt.2

Installing Cilium into a CAPI created cluster on Azure

Automating Cilium CNI Installation on OCI OKE with Pulumi and Python

to move from Flannel to Cilium

First exploration with eBPF

Intro and first POC with Python

Auto-Instrumenting Go Applications Without Modifying Source Code

Using OBI from OTel

Building a Fast eBPF Packet Filter in Go

Filter all outgoing packets from a container according to IP header fields

Cilium + BGP Lab on KIND Cluster

and simulate a ToR switch using FRR

🐝

The Video

Simplifying cross-cluster connectivity with Dapr & Cilium

Talk from ContainerDays in Hamburg

Goodbye Ingress-NGINX Hello Gateway API!

Hear James talk about why you should switch to Gateway API

Runtime Security in GitHub Actions using eBPF

Talk from the Backend Meetup Ljubljana

$100K Research Grants Driving eBPF’s Future

TFIR interviews me on why we are funding academic research

🐝

The Events

CiliumCon NA

November 10th in Atlanta, ping me if you want to meet there!

eBPF Summit 2025: Hackathon Edition

Submissions open Oct 13–Nov 30

Container & Kubernetes Defense feat. eBPF

Training course in Zurich December 9-11

Linux Plumbers Conference

eBPF track schedule out now. Ping me if you want to share some sushi there

CiliumCon EU

CfP now open for Amsterdam. Deadline November 2nd

🐝

The Livestreams

eCHO Episode 195: Clang-free: runtime config for Cilium & eBPF

eCHO Episode 196: Exploring Tetragon on Linux Servers

The Post of the Week

After a while away from microVMs, I finally got Kubernetes running with Cilium. Getting eBPF to work inside a microVM was pretty tricky 😅 Still need to run some tests to make sure everything’s working

As always, if you’ve seen a blog post, a tool, or anything else eBPF or Cilium related that you think the rest of the community should hear about, send them my way. You can either hit reply or join the #echo-news channel on Cilium Slack. You can also find all of the past episodes on the website.

🐝

To make sure you keep getting these emails, please add bill@isovalent.com to your address book or otherwise mark me as a permitted sender.

Know a friend that needs to be in the know? Forward this to them

Was this forwarded to you? Sign up today!

Written and sent by Bill Mulligan. Any feedback is welcome!

KC+CNC_NA_Headshot_241114_William_Mulligan_8154 (1)

I work for Isovalent at Cisco which is leading the eBPF-Powered Revolution in Cloud Native Networking, Observability, and Security with Cilium and Tetragon