devices: drop cilium/ebpf{,link} deps by kolyshkin · Pull Request #64 · opencontainers/cgroups

kolyshkin · 2026-06-23T06:30:52Z

Replace the use of the cilium/ebpf and cilium/ebpf/link with direct
bpf(2) syscalls. Keep cilium/ebpf/asm for instruction assembly.

Notes:

The eBPF device-filter programs are now tracked by raw file
descriptors instead of *ebpf.Program handles;
asm.Instructions.Marshal requires a concrete binary.LittleEndian or
binary.BigEndian, thus endian_{le,be}.go are introduced as a
workaround.

This reduces the runc binary size by about ~1M.

NOTE that this is probably limited to runc, because for other users (k8s, cri-o) this was already solved by opencontainers/runc#4248.

Being tested in opencontainers/runc#5340.

For initial discussion about this, see opencontainers/runc#5218.

…ranch Temporarily point the opencontainers/cgroups dependency at the drop-cilium-ebpf branch (opencontainers/cgroups#64) via a go.mod replace, and re-vendor, so CI can exercise the cilium/ebpf main+link package removal end-to-end in runc. This must not be merged: the replace directive points at a personal fork branch. Once opencontainers/cgroups#64 lands and is tagged, this should be replaced by a normal dependency bump. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Let's drop the second biggest (by size) runc dependency and reduce the binary size by another ~1MB. Draft/DNM until opencontainers/cgroups#64 is merged/released. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Copilot

Pull request overview

This PR refactors the devices eBPF cgroup-device filter implementation to stop importing github.com/cilium/ebpf’s main and link packages, and instead perform the required operations via direct bpf(2) syscalls while continuing to use github.com/cilium/ebpf/asm for instruction assembly. This aligns with the stated goal of reducing consumer binary size by avoiding heavy transitive dependencies.

Changes:

Replaced cilium/ebpf program/link usage with thin wrappers around BPF_PROG_* commands and raw program fds.
Updated cgroup device filter attach/query logic to operate on fds (with explicit closes) instead of *ebpf.Program.
Added nativeEndian selection via build-tagged endian-specific files to satisfy asm.Instructions.Marshal requirements.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
go.sum	Removes now-unused transitive dependencies after dropping `cilium/ebpf` main/link usage.
devices/endian_le.go	Provides `nativeEndian = binary.LittleEndian` under little-endian arch build tags.
devices/endian_be.go	Provides `nativeEndian = binary.BigEndian` under big-endian arch build tags.
devices/ebpf_linux.go	Replaces `ebpf`/`link` usage with direct `bpf(2)` syscall wrappers and fd-based program management.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+	err = bpfProgAttach(dirFd, progFd, attachFlags, replaceFd)
 	if err != nil {
 		return fmt.Errorf("failed to call BPF_PROG_ATTACH (BPF_CGROUP_DEVICE, BPF_F_ALLOW_MULTI): %w", err)
 	}


Let's drop the second biggest (by size) runc dependency and reduce the binary size by another ~1MB. Draft/DNM until opencontainers/cgroups#64 is merged/released. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

kolyshkin · 2026-06-23T16:34:25Z

@cyphar @rata PTAL 🙏🏻

rata

@kolyshkin nice, thanks! Did you c&p the definitions? In that case, can you link them so it's simpler to review?

Also, don't we have overlapping functionality in the cgroups package?

Also, I guess no go.mod changes because it is used for the asm part? Nice that the size is decreased anyways :)

rata · 2026-06-25T12:50:23Z

+}
+
+// bpfProgGetFdByID returns the fd for the BPF program with the given ID.
+func bpfProgGetFdByID(id uint32) (int, error) {


Doesn't the cgroups pkg have this already?

Doesn't the cgroups pkg have this already?

Can you elaborate? The main cgroups package does not have anything to do with EBPF, everything BPF-related is in devices pkg. And there is no such function (implementing BPF_PROG_GET_FD_BY_ID).

kolyshkin · 2026-07-10T01:36:53Z

Also, don't we have overlapping functionality in the cgroups package?

Again I'm afraid I fail to understand what you mean here @rata, can you please elaborate or point to whatever you have in mind?

kolyshkin · 2026-07-10T02:06:58Z

Did you c&p the definitions? In that case, can you link them so it's simpler to review?

I did not, I just recreated a bare minimum (poor boy) version of functionality that we used from cilium/ebpf and cilium/ebpf/link, basically wiring BPF_PROG_LOAD, BPF_PROG_GET_FD_BY_ID, BPF_PROG_ATTACH, BPF_PROG_DETACH and adding related data structures (also as bare minimum).

I have added a separate second commit, linking to the original cilium/ebpf functions. Let me know if you want it or not so I will squash or remove it.

kolyshkin · 2026-07-13T19:59:02Z

@AkihiroSuda @thaJeztah PTAL (I think I've addressed all of your comments).

The second commit is optional and can either be squashed or removed.

kolyshkin

Looking into kernel's tools/lib/bpf/bpf.c, I see that BPF_PROG_LOAD is retried up to 5 times when EAGAIN is received. Also, cilium/ebpf does that (indefinitely).

Implemented the same.

Replace the use of the cilium/ebpf and cilium/ebpf/link with direct bpf(2) syscalls. Keep cilium/ebpf/asm for instruction assembly. Notes: - The eBPF device-filter programs are now tracked by raw file descriptors instead of *ebpf.Program handles; - asm.Instructions.Marshal requires a concrete binary.LittleEndian or binary.BigEndian, so endian.go detects the native byte order at runtime as a workaround. This could be done during compile time but requires maintaining a list of all GOARCHes. This reduces the runc binary size by about ~1M. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Link to cilium/ebpf analogs. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

kolyshkin requested a review from a team as a code owner June 23, 2026 06:30

kolyshkin force-pushed the drop-cilium-ebpf branch 2 times, most recently from d5f40e9 to 733c596 Compare June 23, 2026 06:56

kolyshkin force-pushed the drop-cilium-ebpf branch from 733c596 to cf4738d Compare June 23, 2026 07:12

kolyshkin requested review from AkihiroSuda, Copilot and cyphar June 23, 2026 07:14

Copilot started reviewing on behalf of kolyshkin June 23, 2026 07:15 View session

This was referenced Jun 23, 2026

[DO NOT MERGE] vendor: test opencontainers/cgroups#64 opencontainers/runc#5340

Draft

[dnm/rfc] remove cilium/ebpf dependency to save 1.1M opencontainers/runc#5218

Closed

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Comment thread devices/ebpf_linux.go

Comment thread devices/ebpf_linux.go

Comment on lines +304 to 307

err = bpfProgAttach(dirFd, progFd, attachFlags, replaceFd)

if err != nil {

return fmt.Errorf("failed to call BPF_PROG_ATTACH (BPF_CGROUP_DEVICE, BPF_F_ALLOW_MULTI): %w", err)

}

kolyshkin changed the title ~~devices: drop cilium/ebpf main and link package dependency~~ devices: drop cilium/ebpf{,link} deps Jun 23, 2026

kolyshkin force-pushed the drop-cilium-ebpf branch from cf4738d to 0fd3600 Compare June 23, 2026 07:24

thaJeztah reviewed Jun 23, 2026

View reviewed changes

Comment thread devices/ebpf_linux.go

thaJeztah reviewed Jun 23, 2026

View reviewed changes

Comment thread devices/endian_be.go Outdated

kolyshkin force-pushed the drop-cilium-ebpf branch from 0fd3600 to 8decd05 Compare June 23, 2026 16:28

kolyshkin requested review from dims and haircommander June 24, 2026 20:48

kolyshkin mentioned this pull request Jun 25, 2026

v2: set memory.oom.group => OOMPolicy in systemd #41

Merged

rata reviewed Jun 25, 2026

View reviewed changes

kolyshkin force-pushed the drop-cilium-ebpf branch from 8decd05 to ae8789d Compare July 10, 2026 02:06

kolyshkin commented Jul 13, 2026

View reviewed changes

kolyshkin added 2 commits July 13, 2026 14:22

[wip] devices: annotate new bpf functions

3779064

Link to cilium/ebpf analogs. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

kolyshkin force-pushed the drop-cilium-ebpf branch from ae8789d to 3779064 Compare July 13, 2026 21:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

devices: drop cilium/ebpf{,link} deps#64

devices: drop cilium/ebpf{,link} deps#64
kolyshkin wants to merge 2 commits into
opencontainers:mainfrom
kolyshkin:drop-cilium-ebpf

kolyshkin commented Jun 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kolyshkin commented Jun 23, 2026

Uh oh!

rata left a comment •

edited

Loading

Uh oh!

rata Jun 25, 2026

Uh oh!

kolyshkin Jul 10, 2026

Uh oh!

kolyshkin commented Jul 10, 2026

Uh oh!

kolyshkin commented Jul 10, 2026

Uh oh!

kolyshkin commented Jul 13, 2026

Uh oh!

kolyshkin left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

kolyshkin commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kolyshkin commented Jun 23, 2026

Uh oh!

rata left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rata Jun 25, 2026

Choose a reason for hiding this comment

Uh oh!

kolyshkin Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

kolyshkin commented Jul 10, 2026

Uh oh!

kolyshkin commented Jul 10, 2026

Uh oh!

kolyshkin commented Jul 13, 2026

Uh oh!

kolyshkin left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kolyshkin commented Jun 23, 2026 •

edited

Loading

rata left a comment •

edited

Loading