How GitHub uses eBPF to improve deployment safety

This post details the implementation of eBPF programs to selectively monitor and block network egress from deployment scripts, including DNS queries, and correlate blocked requests with the originating process. It covers using `BPF_PROG_TYPE_CGROUP_SKB` and `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` to intercept and redirect DNS queries to a userspace proxy for blocklist evaluation, and capturing Process IDs to correlate blocked requests with specific commands.