How GitHub uses eBPF to improve deployment safety

GitHub uses eBPF to prevent deployment circular dependencies by blocking network calls.

• •Hooks network egress from deployment cGroups using BPF_PROG_TYPE_CGROUP_SKB
• •Intercepts DNS queries via BPF_PROG_TYPE_CGROUP_SOCK_ADDR and routes them to a userspace proxy
• •Uses eBPF Maps for kernel-userspace communication to evaluate domains against a blocklist
• •Tracks blocked DNS requests by PID and transaction ID for debugging
• •Enables deployments when dependent services are unavailable

This summary was automatically generated by AI based on the original article and may not be fully accurate.