The Untold Story of eBPF's Long Road Into Linux
The story of how eBPF made it into the Linux kernel is as much about technical strategy and persistence as it is about the technology itself. Published late last year, the eBPF documentary captures that history by interviewing the key players from 2014 who fought to get it merged, and also touches on newer developments such as Windows support. The film, which has already screened at KubeCon, is available on YouTube.
For anyone unfamiliar with it, eBPF is a kernel execution engine that runs new kinds of programs in a performant, safe sandbox inside the kernel — conceptually similar to how JavaScript runs untrusted programs safely in a browser. Notably, eBPF is no longer an acronym; it's simply the name of the technology.
From Meeting Room to Merge Window
The documentary brings back memories of the early days. In 2014, when Alexei Starovoitov visited Netflix to discuss eBPF with Brendan Gregg and Amer Ather, the conversation was so engrossing that the trio lost track of time and were eventually evicted from the meeting room to make way for the next booking. It was only then that they realized they'd skipped lunch entirely.
Starovoitov spoke with such confidence that eBPF seemed like an obvious winner. But that confidence was occasionally tempered with a caveat: "if the patches get merged." For those in the room, that conditional felt absurd. The idea was too good to waste — it had to get merged.
The documentary does a good job of conveying that behind-the-scenes struggle, illustrating the sheer effort required to get significant code accepted into a codebase as monumental as Linux. Speakeasy Productions deserves credit for letting viewers experience what it was like in those early days.
A Growing Ecosystem
What began as the work of just a handful of people in 2014 has since grown into a large and active community. By 2015 a handful more had joined, and today hundreds of contributors work on eBPF. A longer cut of the documentary could easily have interviewed dozens of additional developers, including Brendan Blanco (bcc), Yonghong Song (bcc), Sasha Goldshtein (bcc), Alastair Robertson (bpftrace), Tobias Waldekranz (ply), Andrii Nakryiko, Joe Stringer, Jakub Kicinski, Martin KaFai Lau, John Fastabend, Quentin Monnet, Jesper Dangaard Brouer, Andrey Ignatov, Stanislav Fomichev, Teng Qin, Paul Chaignon, Vicent Marti, Dan Xu, Bas Smit, Viktor Malik, Mary Marchini, and many others. Thanks to that collective effort, eBPF has become what it is today.
Ten years on, it still feels like early days for the technology. That makes now a great time to get involved: eBPF is likely already available in production kernels, and there is a mature ecosystem of tools, libraries, and documentation for getting started.
The documentary serves as a reminder that major kernel features don't arrive overnight — they're the result of persistent advocacy, technical quality, and behind-the-scenes effort. The announcement that Cisco intends to acquire Isovalent, widely seen as the role-model eBPF startup, is further confirmation of how far the technology has come.
