Ebpf - GoKawiil

Bomfather cuts eBPF security agent's kernel CPU usage by 90% via inode-level policy caching

The team behind the open-source Bomfather eBPF security agent found that the costliest part of their file-access enforcement wasn't applying allow/deny decisions, but repeatedly walking parent directories to determine which path-based policy applied to a given file. By caching the resolved policy per inode instead of recalculating it on every file open, they cut kernel-side CPU overhead by roughly 90%, particularly benefiting workloads like databases that repeatedly access the same file paths.

nathannaveen.dev · 2026-09-14

BPF Capsule compiler runs full DOOM game logic inside Linux kernel via eBPF

A new project called BPF Capsule compiles large C programs, including a complete DOOM implementation, into standard eBPF bytecode that passes the unmodified Linux verifier and JIT. The system runs game initialization, logic, and rendering entirely inside the kernel, with userspace only supplying the WAD file and keyboard input and receiving back a finished framebuffer each tick. It works without kernel patches or a separate virtual machine, targeting kernels as old as Linux 5.15 on both x86-64 and arm64.

ayles.github.io · 2026-09-09