GitHub4d ago
How GitHub uses eBPF to improve deployment safety
GitHub engineers used eBPF to prevent deployment scripts from introducing circular dependencies and ensure reliability in their deployment system. They created a cGroup to isolate and block network egress from the deployment script, using BPF_PROG_TYPE_CGROUP_SKB to selectively monitor and block network calls. This approach allows GitHub to maintain a safe and reliable deployment system without blocking customer traffic on stateful hosts. The engineers also employed a DNS-based blocked list to block access to specific domains, using an eBPF program type of BPF_PROG_TYPE_CGROUP_SOCK_ADDR to intercept DNS queries and reroute them through a userspace DNS proxy.
DevToolsPlatform
1 min