# Kubernetes Podcast from Google: eBPF and Falco, with Leonardo Di Donato **URL:** \ **Category:** General Discussions\ **Tags:** podcast\ **Created:** [February 18, 2020, 11:11pm UTC](https://discuss.kubernetes.io/t/kubernetes-podcast-from-google-ebpf-and-falco-with-leonardo-di-donato/9772 "2020-02-18T23:11:26Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![castrojo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/castrojo/32/8_2.png) [@castrojo](https://discuss.kubernetes.io/u/castrojo)\ **Post date:** [February 18, 2020, 11:11pm UTC](https://discuss.kubernetes.io/t/kubernetes-podcast-from-google-ebpf-and-falco-with-leonardo-di-donato/9772/1 "2020-02-18T23:11:26Z")
We dive into the Linux kernel this week with guest [Leonardo Di Donato](https://twitter.com/leodido), Open Source engineer at [Sysdig](https://www.sysdig.com/). Leonardo works full-time on the Falco project, a runtime security engine that listens to the Linux kernel using eBPF - the extended Berkeley Packet Filter. Leonardo tells [the hosts](https://kubernetespodcast.com/about) about the architecture of eBPF, how he has used it before and now, and what’s coming up for Falco. Do you have something cool to share? Some questions? Let us know: - web: [kubernetespodcast.com](https://kubernetespodcast.com) - mail: [kubernetespodcast@google.com](mailto:kubernetespodcast@google.com) - twitter: [@kubernetespod](http://twitter.com/kubernetespod) ### Chatter of the week - [University Challenge: can you guess the computer?](https://twitter.com/mrdanwalker/status/1226976395726852096) - Golf Peaks ([Google Play](https://play.google.com/store/apps/details?id=com.Afterburn.GolfPeaks&hl=en_US), [App Store](https://apps.apple.com/us/app/golf-peaks/id1419542293)) - [Desert Golfing](https://en.wikipedia.org/wiki/Desert_Golfing) ### News of the week - [Apache Flink v1.10](https://jaxenter.com/apache-flink-1-10-released-168220.html) - [Linkerd v2.7](https://linkerd.io/2020/02/10/announcing-linkerd-2.7/) - [Azure Container Registry to require TLS 1.2](https://azure.microsoft.com/en-us/updates/update-servers-and-applications-to-tls-1-2-for-secure-communication-with-azure-container-registry-by-jan-3-2020/) - [CPU limits and aggressive throttling in Kubernetes - Omio Engineering](https://medium.com/omio-engineering/cpu-limits-and-aggressive-throttling-in-kubernetes-c5b20bd8a718) by Fayiz Musthafa from Omio - [Kiosk](https://github.com/kiosk-sh/kiosk) - [Reddit thread with Lukas Gentele](https://www.reddit.com/r/kubernetes/comments/f29qug/kiosk_multitenancy_extension_for_kubernetes_now/) - [Docker donates the cnab-to-oci library to cnab.io](https://www.docker.com/blog/docker-donates-cnab-to-oci-library/) - [How-to Guide: Debugging a Kubernetes Application](https://www.cncf.io/blog/2020/02/14/how-to-guide-debugging-a-kubernetes-application/) - [Nutanix Karbon 2.0](https://www.nutanix.com/blog/introducing-nutanix-karbon-2-kubernetes-simplicity-upgraded) - [Childcare](https://www.cncf.io/blog/2020/02/11/childcare-its-good-for-everyone/) and [COVID-19](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/attend/novel-coronavirus-update/) at KubeCon EU - That discount code again again: **[KCEUGKP15](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/register/)** - [Red Hat OpenShift is now available for IBM Z and LinuxONE](https://www.ibm.com/blogs/systems/red-hat-openshift-now-available-ibm-z-linuxone/) - [Why Kubernetes on VMs?](https://neonmirrors.net/post/2020-01/why-k8s-on-vms/) by Chip Zoller - [Securely Access AWS Services from Google Kubernetes Engine (GKE)](https://blog.doit-intl.com/securely-access-aws-from-gke-dba1c6dbccba) - [Carbon Relay raises $63 million](https://venturebeat.com/2020/02/11/carbon-relay-raises-63-million-to-automate-kubernetes-app-deployment/) ### Links from the interview - Traditional Linux tracing tools: [perf](https://en.wikipedia.org/wiki/Perf_(Linux)) and [strace](https://en.wikipedia.org/wiki/Strace) - [BPF and eBPF](https://en.wikipedia.org/wiki/Berkeley_Packet_Filter) - [BPF paper by Steven McCanne and Van Jacobson](https://dl.acm.org/doi/10.5555/1267303.1267305) - [eBPF: Alexei Starovoitov added the ‘e’](https://lwn.net/Articles/740157/) - [Express Data Path (XDP)](https://en.wikipedia.org/wiki/Express_Data_Path) - [bpftrace](https://github.com/iovisor/bpftrace) - [InfluxDB Cloud](https://www.influxdata.com/products/influxdb-cloud/) - [kubectl-trace](https://github.com/iovisor/kubectl-trace) - The [IO Visor project](https://www.influxdata.com/products/influxdb-cloud/) - [Sysdig](https://sysdig.com/) - [Loris Degioanni](https://twitter.com/lorisdegio), co-founder, CTO, and author of [Wireshark](https://en.wikipedia.org/wiki/Wireshark) - [Falco](https://falco.org) - [Sysdig and Falco now powered by eBPF](https://sysdig.com/blog/sysdig-and-falco-now-powered-by-ebpf/) - [Falco joins CNCF Sandbox](https://sysdig.com/blog/falco-cncf-sandbox/) and [moves to incubation](https://www.cncf.io/blog/2020/01/08/toc-votes-to-move-falco-into-cncf-incubator/) - Upcoming KubeCon EU talks by Leonardo: - [Going beyond CI/CD with Prow](https://kccnceu20.sched.com/event/ZenU/going-beyond-cicd-with-prow-leonardo-di-donato-sysdig) - [Designing a gRPC interface for kernel tracing with eBPF](https://kccnceu20.sched.com/event/Zexb/designing-a-grpc-interface-for-kernel-tracing-with-ebpf-leonardo-di-donato-sysdig) - Falco community: - [Docs](https://falco.org/docs) - [Mailing list](https://lists.cncf.io/g/cncf-falco-dev) - [Notes about community calls](https://github.com/falcosecurity/community) - [Community call recordings](https://www.youtube.com/channel/UCd7LDOK1nN5jIULHk-LJJtA) - [Slack](https://slack.sysdig.com) - [Leonardo Di Donato](https://twitter.com/leodido) on Twitter Original Source: [https://kubernetespodcast.com/episode/091-ebpf-and-falco/](https://kubernetespodcast.com/episode/091-ebpf-and-falco/)