Guide Running a pre-flight DaemonSet Upgrading Micro Versions Upgrading Minor Versions Rolling Back Version Specific Notes Advanced Configura�on Network Policy Policy Enforcement Modes Rule Basics Layer 3 VirtualBox that run on Linux, macOS, and Windows. Install kubectl & minikube Install kubectl version >= v1.10.0 as described in the Kubernetes Docs [h�ps://kubernetes.io/docs/tasks/tools/install-kubectl/] minikube version minikube version: v0.33.1 Create a minikube cluster: minikube start --network-plugin=cni --memory=4096 Note that in case of installing Cilium for a specific Kubernetes version, the

Summary Linux Distribution Compatibility Matrix Linux Kernel Advanced Features and Required Kernel Version Key-Value store clang+LLVM iproute2 Firewall Rules Privileges Upgrade Guide Running pre-flight pre-flight check (Required) Upgrading Micro Versions Upgrading Minor Versions Step 3: Rolling Back Version Specific Notes Advanced Configuration Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples VirtualBox that run on Linux, macOS, and Windows. Install kubectl & minikube 1. Install kubectl version >= v1.10.0 as described in the Kubernetes Docs [https://kubernetes.io/docs/tasks/tools/install-kubectl/]

Required Kernel Version Key-Value store clang+LLVM iproute2 Firewall Rules Privileges Upgrade Guide Running pre-flight check (Required) Upgrading Cilium Step 3: Rolling Back Version Specific Notes Advanced VirtualBox that run on Linux, macOS, and Windows. Install kubectl & minikube 1. Install kubectl version >= v1.10.0 as described in the Kubernetes Docs [https://kubernetes.io/docs/tasks/tools/install-kubectl/] configuration that is not compatible with the TPROXY requirements of Cilium >= 1.6.0. minikube version minikube version: v1.3.1 commit: ca60a424ce69a4d79f502650199ca2b52f29e631 3. Create a minikube cluster:

eBPF filesystem Privileges Upgrade Guide Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule VirtualBox that run on Linux, macOS, and Windows. Install kubectl & minikube 1. Install kubectl version >= v1.10.0 as described in the Kubernetes Docs [https://kubernetes.io/docs/tasks/tools/install-kubectl/] configuration that is not compatible with the TPROXY requirements of Cilium >= 1.6.0. minikube version minikube version: v1.3.1 commit: ca60a424ce69a4d79f502650199ca2b52f29e631 3. Create a minikube cluster:

eBPF filesystem Privileges Upgrade Guide Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Development in Vagrant Box Making Changes Add/update a golang dependency Add/update a new Kubernetes version Optional: Docker and IPv6 Debugging Building Container Images Developer images Official release VirtualBox that run on Linux, macOS, and Windows. Install kubectl & minikube 1. Install kubectl version >= v1.10.0 as described in the Kubernetes Docs [https://kubernetes.io/docs/tasks/tools/install-kubectl/]

eBPF filesystem Privileges Upgrade Guide Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Development in Vagrant Box Making Changes Add/update a golang dependency Add/update a new Kubernetes version Optional: Docker and IPv6 Debugging Building Container Images Developer images Official release implications. Note BYOCNI requires the aks-preview CLI extension with version >= 0.5.55, which itself requires an az CLI version >= 2.32.0 . export NAME="$(whoami)-$RANDOM" export AZURE_RESOURCE_GROUP="${NAME}-group"

eBPF filesystem Privileges Upgrade Guide Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Development in Vagrant Box Making Changes Add/update a golang dependency Add/update a new Kubernetes version Optional: Docker and IPv6 Debugging Building Container Images Developer images Official release implications. Note BYOCNI requires the aks-preview CLI extension with version >= 0.5.55, which itself requires an az CLI version >= 2.32.0 . export NAME="$(whoami)-$RANDOM" export AZURE_RESOURCE_GROUP="${NAME}-group"

process confinement from the ground up. 3 / 7 bpfbox Implementation ▶ Userspace daemon using the Python3 bcc framework ▶ Kernelspace components are all eBPF ▶ LSM probes (KRSI), kprobes, uprobes, tracepoints

#/home/manashuk/Documents# kernel.pid_max = 4194304 [1]+ Done sysctl kernel.pid_max root@ubuntu:/home# python breakpoint.py 0xffffffffaa2623b0 -1 3 Kernel Stack : scan_block scan_gray_list kmemleak_scan kmemleak_scan_thread

Future plans - Integrate in Facebook’s profiling infra - Rewrite OSS driver program - Make the OSS version awesome - Better documentation (including how to measure overhead) - Add more output formats