O'Reilly needs to choose a new theme for their covers besides animals because they just peaked for Cilium Up and Running. I also love the symbolism of having two bees on the cover. Besides being the comprehensive guide to Cilium, the book also aims to bring the platform/DevOps engineer closer to the network engineer to help both sides better understand each other’s challenges and encourage stronger collaboration. ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­    ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­  
View in browser
echo-newsletter 102

eCHO news is your bi-weekly wrap up of all things eBPF and Cilium. If you want to keep up on the latest in cloud native networking, observability, and security this is your quelle

24th February 2026

 

O'Reilly needs to choose a new theme for their covers besides animals because they just peaked for Cilium Up and Running. I also love the symbolism of having two bees on the cover. Besides being the comprehensive guide to Cilium, the book also aims to bring the platform/DevOps engineer closer to the network engineer to help both sides better understand each other’s challenges and encourage stronger collaboration.

 

Cloud native blurred the lines between those roles with layers of abstraction. This book leans into that reality and tries to give both sides a shared language. I think that might be even more valuable than another YAML network policy example. Hats off to my colleagues Nico Vibert, Filip Nikolic, and James Laverack for all the time, work, and effort they put into making this a reality. I'm off to Morocco for the first bikepacking trip of the year and need to clean the bike so let’s 🐝 -gin.

The Technical

Hardening eBPF for runtime security: Lessons from Datadog Workload Protection

All the foot guns Datadog found and how to mitigate them

 

Happy Birthday XDP!

10 years old now too and just getting started

 

How Meta turned the Linux Kernel into a planet-scale Load Balancer. Part II

"The most efficient packet is the one you never have to touch"

 

Why we abandoned userspace security for bare-metal eBPF

29,376 Events/Sec. 0 Escapes.

 

eghostbuster: An eBPF-based tool for detecting and cleaning up stale kernel resources

Get rid of ghost rescues with this Github repo

 

tylerflint/bpftime-go

Go module for running eBPF programs without root or kernel eBPF support

 

msune/l2radar

An eBPF L2 neighbour tracker

 

tsint/bpfviewer

A tool for disassembling, analyzing, debugging, and visualizing BPF object files

 

rogercoll/eprofiler-tui

eBPF profiler flamegraph based TUI 🐧🐝

 

DavidHavoc/ayaFlow

A high-performance, eBPF-based network traffic analyzer written in Rust

 

zz85/profile-bee

🐝🦀🔥 Rust-based eBPF CPU profiler, supports stack unwinding

 

beelzebub-labs/azazel

Linux Runtime Security and Forensics using eBPF

 

Otsmane-Ahmed/KEIP

Detect and block malicious network activity during pip install with eBPF/LSM

 

manmohanmirkar123/cilium_analyzer

A static analysis tool for Cilium CNI manifests

 

aminassadi/spk

Single Packet Authentication with eBPF

🐝

 

The Ecosystem

eBPF In Production

Report from eBPF Foundation putting production ROI numbers together

 

Cilium: Up and Running

The best cover O’Reilly has ever made, now free for download

 

The RISC architecture frontier: Is eBPF ready for ARM64 and RISC-V?

It is all about the ecosystem flywheel which eBPF Foundation is helping with

 

How We Secure Builds With fs-verity

eBPF to secure building eBPF

 

Disciplined Composition: building Cloud Native infrastructure that scales

"Build skills before you build platforms"

🐝

 

The How To

Different Ways To Deliver Kernel Events from eBPF to User Space Coding Lab

Find out if a Ring Buffer or Perf Buffer is better

 

Cilium Networking & eBPF-Powered Security Policies on RKE2

Or when to switch from Canal to Cilium

 

All The Ways To Loop and Iterate in eBPF

Any guesses which way came first?

 

Direct Server Return with Cilium

or how to preserve the source IP address of client requests

 

Learning eBPF - Chapter 3: Anatomy of eBPF Programs

Understood how a program is compiled, loaded, inspected, and managed

 

Kubernetes: Where to Start Without Getting Overwhelmed

The sweetspot: K3s + Cilium CNI plus installation guide

🐝

 

The Video

Cilium Explained: eBPF-Powered Kubernetes Networking

Duffie and Whitney discuss Cilium on a light board

 

Interview with Bill Mulligan, Cilium Maintainer | eBPF Network, Security & Multi-Cluster Kubernetes

I definitely needed a hair cut in this video

 

Why eBPF Is Redefining How Software Runs Inside the Linux Kernel

My haircut is much better in this video

 

eBPF: La tecnología que rediseñó el kernel de Linux

Spanish intro to eBPF

 

Talks from Cloud Native Days France on Cilium ClusterMesh and Direct Server Return

🐝

 

The Events

CiliumCon EU

Schedule out now!

 

ACM SOSP'26 Workshop on eBPF and Kernel Extensions

September 29th in Prague, CfP open

🐝 

The Livestreams

eCHO Episode 202: Exploring New Features in Cilium 1.19

eCHO Episode 202: Exploring New Features in Cilium 1.19

  

eCHO Episode 203: eBPF Hookpoint Gotchas

eCHO Episode 203: eBPF Hookpoint Gotchas

The Post of the Week

Screenshot 2026-02-24 at 13.46.34

As always, if you’ve seen a blog post, a tool, or anything else eBPF or Cilium related that you think the rest of the community should hear about, send them my way. You can either hit reply or join the #echo-news channel on Cilium Slack. You can also find all of the past episodes on the website.

🐝

To make sure you keep getting these emails, please add bill@isovalent.com to your address book or otherwise mark me as a permitted sender.

 

Know a friend that needs to be in the know? Forward this to them

Was this forwarded to you? Sign up today!

Written and sent by Bill Mulligan. Any feedback is welcome!

LF_KCCNC_headshot_251113_Bill_Mulligan_9686

I work for Isovalent at Cisco which is leading the eBPF-Powered Revolution in Cloud Native Networking, Observability, and Security with Cilium and Tetragon

logo-wordmark-isovalent-vertical-dark@2x
LinkedIn
Bluesky_Logo.svg

Cisco/Isovalent, LLC, 755 Sycamore Drive, Milipitas, CA 95035, United States

Unsubscribe Manage preferences