Solo.io, a company developing products for the operation of cloud systems, microservices, isolated containers, and serverless computing, has released the open-source toolkit BumbleBee, designed to simplify the preparation, distribution, and execution of eBPF programs running in a dedicated virtual machine within the Linux kernel, allowing for network operations processing, access control, and system monitoring. The code is written in Go and is distributed under the Apache 2.0 license.
BumbleBee enables packaging an eBPF program as an OCI (Open Container Initiative) container image, which can be run on any system without recompilation or the need for additional user space components. BumbleBee handles interactions with eBPF code in the kernel, including processing data from incoming eBPF handlers, automatically exporting this data as metrics, histograms, or logs, which can be accessed using utilities like curl. This approach allows developers to focus on writing eBPF code without being distracted by managing interactions with this code from user space, building, and loading into the kernel.
To manage eBPF programs, a Docker-style utility called 'bee' is provided, which allows users to load a desired eBPF handler from an external repository and run it on a local system. The toolkit can generate a C code scaffold for eBPF handlers of a selected theme (currently supporting only handlers for network and file operations that intercept calls to the network stack and file systems). Based on the generated scaffold, developers can quickly implement the functionalities they are interested in.
Unlike BCC (BPF Compiler Collection), BumbleBee does not perform a full rebuild of the handler code for each version of the Linux kernel (BCC uses just-in-time compilation with Clang on each execution of the eBPF program). To address portability issues, the CO-RE and libbpf toolchains are being developed, allowing the code to be compiled only once and utilizing a special universal loader that adapts the loaded program to the current kernel and BTF (BPF Type Format) types. BumbleBee is a layer on top of libbpf and provides additional types for the automatic interpretation and visualization of data stored in common eBPF map structures, RingBuffer and HashMap.
To build the final eBPF program and save it as an OCI image, simply execute the command "bee build source_file code_name:version", and to run it, use the command "bee run code_name:version". By default, events generated by the handler will be output to the terminal window, but if needed, data can also be obtained by using curl or wget utilities directed at the network port associated with the handler. Handlers can be distributed through OCI-compatible repositories; for instance, to run an external handler from the repository ghcr.io (GitHub Container Registry), execute the command "bee run ghcr.io/solo-io/bumblebee/tcpconnect:$(bee version)". To place a handler in the repository, the command "bee push" is suggested, and for tagging a version, use "bee tag".
Source: opennet.ru
