Blogs›GitHub›eBPF for Deployment Safety
This feature thread tracks the evolution of using eBPF to enhance deployment safety by preventing circular dependencies. Initially, the focus was on identifying and mitigating direct, hidden, and transient dependencies that could halt deployments. This post details the implementation of eBPF programs to selectively monitor and block network egress from deployment scripts. Specifically, it covers using `BPF_PROG_TYPE_CGROUP_SKB` for egress filtering and `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` to intercept and redirect DNS queries to a userspace proxy for blocklist evaluation. The system also correlates blocked DNS requests with the originating process and command line for improved debugging and auditing.
4/16/2026
This post introduces the use of eBPF to prevent circular dependencies during deployments. It details the architecture involving `BPF_PROG_TYPE_CGROUP_SKB` for network egress filtering and `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` for DNS interception. The implementation uses the `cilium/ebpf` Go library and a userspace DNS proxy. It also describes how to correlate blocked DNS requests with PIDs and command lines using eBPF maps.