Those safety boundaries are what made modern kernel programmability possible in the first place.

eBPF was never meant to replace the kernel. It was meant to make extending it safe. And that’s exactly why the industry is moving away from custom modules and toward eBPF-based extensions because they're portable, secure, and deployable.

For this use cases, maybe privileged doesn't mean kernel space. The real power comes from combining eBPF for observation and control with user-space agents that handle policy, analysis, and orchestration. It's a pattern I'm seeing everywhere now.

That quote perfectly captures one of the biggest transitions happening right now in infrastructure software, the eBPFification of everything. eBPF has become the default, not the alternative.

and still are now 📶

See you there! 🍣