How GitHub Uses eBPF to Enhance Deployment Safety
Discover how eBPF technology resolves circular dependencies in deployment processes.
1GitHub Hosting Its Own Source Code
GitHub hosts its own source code on github.com. This allows them to test changes internally before releasing them to users. However, this approach introduces the risk of losing access to their own code if the platform goes down.
2The Risks of Circular Dependencies
Circular dependencies can emerge in GitHub's deployment processes. For example, a deployment script might fail if it tries to download a binary from GitHub while the platform is down.
3The Role of eBPF
eBPF (extended Berkeley Packet Filter) allows custom programs to be loaded into the Linux kernel and hooked into core system functions. GitHub used eBPF to prevent deployment scripts from creating circular dependencies.
4Direct Dependencies
A MySQL deployment script might attempt to pull the latest release of an open-source tool from GitHub. If GitHub is unavailable, the script will fail.
5Hidden Dependencies
A deployment script might use a tool already present on the machine. However, if the tool checks GitHub for updates and cannot connect, the script may fail.
6Transient Dependencies
A deployment script might call an internal service via an API, which in turn tries to fetch a binary from GitHub. If GitHub is down, the error propagates back to the script.
7Solving with eBPF
GitHub used eBPF to restrict network access for deployment scripts. This prevents specific scripts from accessing GitHub, thereby avoiding circular dependencies.
8Creating eBPF Programs
GitHub engineers began writing eBPF programs in Go. These programs are loaded into the Linux kernel to monitor and control network traffic.
9The Future of eBPF
eBPF technology not only enhances deployment safety at GitHub but also offers solutions for similar challenges faced by other companies. This technology is ushering in a new era in systems engineering.
Original article: GitHub Engineering — GitHub'un eBPF ile Dağıtım Güvenliğini Artırma Yöntemi