Learn how Github uses eBPF to detect and prevent circular dependencies in its deployment tooling. The post How GitHub uses eBPF to improve deployment safety appeared first on The GitHub Blog.
AI Summary
GitHub mitigates a circular dependency issue that arises when their deployment script attempts to access their own source code during a deployment, causing a service outage. By using eBPF, they selectively block network calls from specific scripts, preventing direct dependencies on GitHub. The eBPF program monitors and modifies network requests from the script, allowing them to maintain system integrity. They then create a cGroup, where they place their deployment script, and use eBPF to limit the script's outbound network access to prevent the script from accessing GitHub during a service outage. The team also implements a DNS-based block list using eBPF, redirecting DNS queries from the deployment script to a userspace proxy that prevents access to blocked domains. With these measures in place, GitHub ensures that their deployment scripts do not create circular dependencies, maintaining system integrity during outages and preventing service disruptions.
Get the top 10 engineering articles delivered every Monday.