Docker & libnetwork Mesos Cilium with Mesos/Marathon Envoy Envoy Go Extensions Administration System Requirements Summary Linux Distribution Compatibility Matrix Linux Kernel Advanced Features and to gain visibility and to troubleshoot issues is fundamental to the operation of any distributed system. While we learned to love tools like tcpdump and ping and while they will always find a special place Installation You can monitor as Cilium and all required components are being installed: kubectl -n kube-system get pods --watch NAME READY STATUS RESTARTS

Docker & libnetwork Mesos Cilium with Mesos/Marathon Envoy Envoy Go Extensions Administration System Requirements Summary Linux Distribution Compatibility Matrix Linux Kernel Advanced Features and to gain visibility and to troubleshoot issues is fundamental to the operation of any distributed system. While we learned to love tools like tcpdump and ping and while they will always find a special place Installation You can monitor as Cilium and all required components are being installed: kubectl -n kube-system get pods --watch NAME READY STATUS RESTARTS

with Docker & libnetwork Mesos Cilium with Mesos/Marathon Envoy Envoy Go Extensions Administra�on System Requirements Summary Linux Distribu�on Compa�bility Matrix Linux Kernel Key-Value store clang+LLVM ability to gain visibility and to troubleshoot issues is fundamental to the opera�on of any distributed system. While we learned to love tools like tcpdump and ping and while they will always find a special run Cilium inside microk8s, a GNU/Linux distribu�on with kernel 4.9 or later is required (per the System Requirements). Install microk8s Install microk8s >= 1.14 as per microk8s documenta�on: MicroK8s

cramped engine room, Its critical systems of metal and fire. eBPF originates from Linux, an operating system that runs on billions of devices around the world and is divided into user space (where most applications entire system and is highly performant, but needs to provide a stable interface to applications, so it lacks the flexibility of user space programming. Applications User space Kernel System calls adjustments to adapt to the evolution of the kernel. Applications User space Kernel System calls Files Networking Process Module Memory One day, a concerned Captain Tux reviewed the crew And remembered that

(Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Linux Distribution Compatibility & Considerations Linux Kernel Required Kernel to gain visibility and to troubleshoot issues is fundamental to the operation of any distributed system. While we learned to love tools like tcpdump and ping and while they will always find a special place -plugins/#network- plugin-requirements]) Linux kernel >= 4.9.17 Tip See System Requirements for more details on the system requirements. Install Cilium Install Cilium into the Kubernetes cluster pointed

(Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Architecture Support Linux Distribution Compatibility & Considerations Linux to gain visibility and to troubleshoot issues is fundamental to the operation of any distributed system. While we learned to love tools like tcpdump and ping and while they will always find a special place -plugins/#network- plugin-requirements]) Linux kernel >= 4.9.17 Tip See System Requirements for more details on the system requirements. Install Cilium Install Cilium into the Kubernetes cluster pointed

(Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Linux Distribution Compatibility Matrix Linux Kernel Required Kernel Versions to gain visibility and to troubleshoot issues is fundamental to the operation of any distributed system. While we learned to love tools like tcpdump and ping and while they will always find a special place parameter in minikube start command. With this flag enabled, minikube will not only mount eBPF file system but also deploy quick- install.yaml automatically. However, this may not install the latest version

Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Security Bugs Operations System Requirements Summary Linux Distribution Compatibility Matrix Linux Kernel Required Kernel Versions to gain visibility and to troubleshoot issues is fundamental to the operation of any distributed system. While we learned to love tools like tcpdump and ping and while they will always find a special place parameter in minikube start command. With this flag enabled, minikube will not only mount eBPF file system but also deploy quick- install.yaml automatically. 4. Mount the eBPF filesystem minikube ssh --

are not well suited for a dev platform ● The processing overhead is non-trivial ● Falco's eBPF module + ContainerOS was not very performant Attempt #1 - The Postmortem Iteration is key ● Built a Use Ubuntu instead of ContainerOS Current Implementation Iteration is key ● Move back to eBPF module to reduce our OS footprint ● Smarter rules based on user behavior ● Automatically respond to

AppArmor TOMOYO ▶ Can we do any better? 2 / 7 eBPF Changes the Game eBPF enables: ▶ Fine-grained system introspection ▶ Integration of cross-layer state (kprobes, uprobes, etc.) with policy enforcement vanilla Linux kernel ≥ 5.8 4 / 7 Our Policy Language Rules and Directives Rules specify access to system objects: ▶ fs(file, access) ▶ net(socket, access) ▶ signal(prog, sig) ▶ etc. Directives augment