Conntrack Pre-route route IPVS entry Post-route Iptables snat Conntrack Post-route Pre-route IPVS entry BPF SNAT IPVS mode data path IPVS-eBPF mode data path How eBPF does SNAT • Why does SNAT with eBPF NodePort +64% -47% +22% Test result • Perf shows number of instructions per request drops by 38% IPVS-BPF IPVS 0 20000 40000 60000 80000 100000 120000 140000 160000 180000 Nodeport short connection #param unroll • Size limitation of BPF program <= 4096 • Move SNAT allocate port loop into IPVS kernel module • Bounded loop support in Linux 5.3 • Size limitation of BPF program is one million after Linux

sealfs 直接从容器拦截 IO，对接 sealfs 分布式文件系统，避免 fuse 用户态内核态反复横跳 在 Sealos 上使用 GPU 在 Sealos 上利用 Cilium + BPF 实现流量统计 Slide source credit to: How to Make Linux Microservice-Aware with Cilium and eBPF (InfoQ, 2019)