Meetup #12: Inspektor Gadget and traceloop: BPF debugging tools for Kubernetes

This meetup will be conducted in English. / Meetup odbędzie się w języku angielskim.

Summary:
I will present Inspektor Gadget and traceloop, a tool for tracing system calls in cgroups or in containers using in-kernel Berkeley Packet Filter (BPF) programs.

Many people use the “strace” tool to synchronously trace system calls using ptrace. Traceloop similarly traces system calls but with very low overhead (no context switches) and asynchronously in the background, using BPF and tracing per cgroup. I’ll show how it is integrated with Kubernetes via Inspektor Gadget.

Traceloop's traces are recorded in a fast, in-memory, overwritable ring buffer like a flight recorder. As opposed to “strace”, the tracing is permanently enabled on Kubernetes pods and can be inspected in case of a crash. It’s like a always-on “strace in the past”.

I will also present Kinvolk’s Kubernetes distribution Lokomotive and the OS it relies on, Flatcar Container Linux - a friendly fork of CoreOS Container Linux - to show the integration that is possible when we control the full stack from the Linux kernel to Kubernetes.

https://github.com/kinvolk/inspektor-gadget
https://github.com/kinvolk/traceloop

Speaker:
Alban is CTO & co-founder of Kinvolk. He has a particular interest in integrating BPF into Kubernetes. He’s a maintainer of the gobpf library and has worked on software in the cloud space using BPF with Golang: Weave Scope, Traceleft, Project Calico, and recently Inspektor Gadget and Traceloop.