devopsy.kinsta.cloud

Tag: microkernel

  • Foundation Proposes Advancing eBPF Adoption Across Multiple OSes

    Foundation Proposes Advancing eBPF Adoption Across Multiple OSes

    The eBPF Foundation, which proposes to advance adoption of an approach that enables sandbox programs to run faster at the kernel level, is being launched today as an arm of the Linux Foundation.

    The technology known as eBPF was originally developed for Linux. The eBPF Foundation is now committed to expanding use of eBPF across all operating systems. Members of the eBPF Foundation include Facebook, Google, Isovalent, Microsoft and Netflix.

    Thomas Graf, CTO and co-founder of Isovalent, a provider of networking and security tools that leverage eBPF, said IT organizations should expect to see the technology become part of Windows, along with other operating systems, as the core technology is tested and validated across a much wider range of platforms.

    In effect, eBPF changes the way operating systems are designed. It bridges the boundary between kernel and user space by enabling developers to combine and apply logic across multiple subsystems that, historically, were completely independent of one another. That approach enables, for example, a security tool to scale to the point where it can identify threats at much higher levels of throughput to improve overall scale at a time when the volume of cybersecurity attacks being simultaneously launched continues to increase.

    Currently, eBPF is widely employed by web-scale companies such as cloud service providers. Facebook is using it as the primary software-defined load balancer in its data centers while Google is using open source Cilium networking software within its managed Kubernetes offerings.

    However, adoption within on-premises IT environments that have deployed Linux has been more limited simply because the number of vendors that have optimized networking, security and storage offerings to take advantage of eBPF is still fairly limited.

    Sysdig, for example, recently launched made available an instance of the open source Falco container security platform available that employs eBPF. Tigera has also made available an instance of its container networking platform that leverages eBPF at the kernel level of Linux.

    Ultimately, Graf notes the biggest benefit of eBPF is efficiency. The total cost of processing for security, networking and storage platforms should decline as more vendors take advantage of a capability that will one day be widely employed across multiple operating systems.

    In the meantime, IT organizations would be well-advised to ask their vendors when they plan to support eBPF. Cloud service providers generally require it to deliver their own managed services more efficiently, so any vendor that hopes to sell a platform to those providers will need to support eBPF to drive performance at scale. The issue then becomes determining which platforms that have embraced the technology are also available in on-premises IT environments looking for similar benefits.

    Regardless of approach, it’s clear there will soon be a reason to upgrade not just networking, storage and security platforms but also instances of operating systems that don’t yet support eBPF. DevOps teams would be well-advised to plan accordingly because the number of platforms that will ultimately benefit from eBPF spans the entire enterprise.

  • The Linux Foundation Throws Weight Behind Secure Microkernel

    The Linux Foundation Throws Weight Behind Secure Microkernel

    The Linux Foundation announced today it will host the seL4 Foundation, the nonprofit organization established by Data61, an arm of Commonwealth Scientific and Industrial Research Organization (CSIRO) in Australia that has been developing the seL4 microkernel operating system.

    Gernot Heiser, who will serve as chair of the new foundation, said the seL4 is unique in that it is mathematically proven to be secure, which provides a robust foundation on which a new generation of embedded systems can be built to drive, for example, internet of things (IoT) applications.

    Founding members of the seL4 Foundation include Data61, University of New South Wales in Sydney, HENSOLDT Cyber GmbH, Ghost Locomotion Inc., Cog Systems Inc. and DornerWorks Ltd.

    The hosting of the seL4 Foundation is sure to add more fuel to an increasingly fierce debate over the future of operating systems. Advocates of microkernels contend operating systems in terms of functions and size should be kept to an absolute minimum to both ensure security and maximize flexibility.

    Rather than loading functions into the operating system, most functions should be accessed in user space above the operating system. That approach allows organizations to take advantage of a modular architecture to swap capabilities out as they best see fit.

    However, supporters of traditional operating systems such as Linux and Windows contend organizations are better served by operating systems that run the same functions consistently. Linus Torvalds, who oversees the development of the core Linux operating system, has been especially critical of microkernel-based approaches to building operating systems.

    Between those two extremes have emerged containers, which package many of the functions once handled by the operating system into a container alongside application code to make it easier to run containers on multiple variants of operating systems. That shift has subsequently led to increased reliance on lighter-weight operating systems that only provide the basic functions required to run a container.

    Microkernel-based operating systems in time most will likely lend themselves better to many emerging use cases, especially on various emerging edge computing platforms where security is a paramount concern. The smaller the operating system, the less attack surface there is to defend. One of the issues that organizations of all sizes contend with today is the stack of software that needs to be defended is a lot larger than they may absolutely require.

    Of course, it remains to be seen how much momentum The Linux Foundation can generate for the seL4 project, which currently is supported only by a relatively small number of organizations. The degree to which organizations may back seL4 or some other similar initiative may come down to the degree to which they have grown tired of ceding control over what goes into an operating system to either Microsoft or the oligarchy that currently dominates the development of Linux. Regardless of where any organization falls on that spectrum, the one thing that is clear is given the scope of all the other open source projects supported by The Linux Foundation, it’s probable a lot more organizations are about to become a lot more involved in that debate whether they want to or not.

    — Mike Vizard