How eBPF and XDP Are Reshaping High-Speed Linux Packet Processing

·1 views

eBPF (extended Berkeley Packet Filter) is a sandboxed virtual machine built into the Linux kernel that allows developers to run verified, safe programs at the kernel level without risking system crashes. XDP (eXpress Data Path) uses eBPF to intercept and process network packets at the earliest possible point — right at the network interface — before they reach the full kernel networking stack. This enables extremely fast operations such as dropping malicious traffic, redirecting packets, modifying headers, and collecting granular traffic statistics. XDP is particularly valuable for mitigating DDoS attacks and enabling load balancing or network function virtualization at high speed. To use XDP and eBPF, developers need a Linux kernel version 4.8 or later along with the Clang and LLVM compiler toolchain.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Set Up Zero-Trust Encrypted Backups Using Restic on Ubuntu 24.04

Restic, an open-source backup tool written in Go, offers client-side AES-256-CTR encryption and content-defined block-level deduplication, addressing key weaknesses in traditional backup approaches. Unlike legacy sync tools, Restic natively supports cloud storage such as S3 without requiring third-party proxies or mounts. A critical security consideration involves IAM policy configuration: broadly denying S3 delete permissions breaks Restic's lock-file cleanup mechanism, so delete access must be selectively allowed for the locks/ directory only. Storing unrestricted cloud credentials on the host machine poses a serious ransomware risk, as compromised root access can enable permanent deletion of off-site backups. Additionally, automating Restic installation by querying the GitHub API at scale can trigger rate limits, causing failed deployments across large server fleets.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents in CI/CD Pipelines Cut PR Review Bottlenecks Without Replacing Engineers

Engineering teams often struggle with pull request backlogs as developers submit PRs faster than reviewers can process them. By embedding AI agents directly into CI/CD pipelines, routine triage tasks such as categorizing PRs, flagging lint violations, summarizing test failures, and assigning labels can be automated before a human reviewer ever opens the request. The AI agent analyzes each pull request immediately after CI starts, producing structured summaries and suggested fixes instead of raw build logs, reducing context-switching for reviewers. A key guardrail in this approach is that the AI never merges code autonomously — it assists reviews rather than approving production changes. Platforms including GitHub, GitLab, Harness, and AI-native tools are increasingly moving toward this model of friction-reducing automation across the software delivery lifecycle.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Fix GitLab CI Docker Socket Connection Error in CI Jobs

GitLab CI jobs fail with a 'Cannot connect to the Docker daemon at unix:///var/run/docker.sock' error when the DOCKER_HOST environment variable is not set, causing the Docker client to look for a local socket that does not exist inside the job container. The Docker daemon runs in a separate docker:dind service container, so the job container finds nothing listening on the local socket. The fix requires setting DOCKER_HOST to tcp://docker:2376 and keeping TLS-related variables consistent, using port 2376 when TLS certificates are configured and port 2375 only when TLS is explicitly disabled. A misconfigured or missing dind service — often due to the runner lacking privileged mode in its config — can also trigger the same error even when DOCKER_HOST is correctly set. This error is distinct from the tcp://docker:2375 variant, which points to a reachability or TLS mismatch issue rather than a missing DOCKER_HOST setting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Typed Seam, Not a Rule Engine, Fixes Hardcoded Business Logic

Software teams often frame externalizing business rules as a tooling choice — picking an npm package in Node.js or adopting Drools in Java — but the real architectural move is defining a clean, typed boundary between the service and the rule layer. The core pattern replaces inline conditional logic with a typed input, a typed output, and a rule set evaluated externally, so the calling code never needs to know the rule engine's internals. Both compile-time types and runtime schema validation are essential: the compiler catches mismatches in your own code, while runtime checks catch silent shape changes when a rule layer is updated underneath you. Skipping the runtime boundary means a rule change that renames a field can fail silently in production rather than loudly in a test. Once this seam is correctly established, the choice of engine, language, or hosting becomes an implementation detail rather than the central decision.

0 comments Read more at DEV Community