Skip to content

[POC] Use eBPF instead of seccomp or polling for bind and listen tracking#40178

Draft
chemwolf6922 wants to merge 7 commits intomasterfrom
user/chemwolf6922/use-bpf-for-bind-monitoring
Draft

[POC] Use eBPF instead of seccomp or polling for bind and listen tracking#40178
chemwolf6922 wants to merge 7 commits intomasterfrom
user/chemwolf6922/use-bpf-for-bind-monitoring

Conversation

@chemwolf6922
Copy link
Copy Markdown
Contributor

TODO

  • The compiled eBPF program (.skel.h files) and the libbpf library needs to ship in a nuget package.
  • Building libelf (libbpf's dependency) with musl requires patching.
  • This breaks the Linux cannot bind ports bound by windows scenario. Needs more work.

Summary of the Pull Request

PR Checklist

  • Closes: Link to issue #xxx
  • Communication: I've discussed this with core contributors already. If work hasn't been agreed, this work might be rejected
  • Tests: Added/updated if needed and all pass
  • Localization: All end user facing strings can be localized
  • Dev docs: Added/updated if needed
  • Documentation updated: If checked, please file a pull request on our docs repo and link it here: #xxx

Detailed Description of the Pull Request / Additional comments

Validation Steps Performed

Copilot AI review requested due to automatic review settings April 14, 2026 10:19
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants