[$] Examining other network namespaces using BPF
Jordan Rife's work involves writing BPF programs for Cilium that interface with Kubernetes networking. As part of that work, he wants to enable BPF programs with appropriate permissions to iterate through the sockets of a different network namespace. He led a session about the idea at the 2026 Linux Storage, Filesystem, Memory-Management, and BPF Summit where the BPF developers in attendance were…
The BPF program developer Jordan Rife is working on enabling BPF programs with permissions to iterate through sockets in other network namespaces for Cilium, a Kubernetes networking solution. At a 2026 Linux summit, BPF developers suggested alternatives, including a new iterator that could scan all sockets on a system, regardless of network namespace.
This would allow Cilium to avoid changing network namespaces and scanning sockets multiple times, improving efficiency. Rife considered keeping a list of socket-to-backend mappings, but found it more complex. He also considered adding a sleepable variant of bpf_sock_destroy() to acquire the socket lock, but ultimately abandoned the idea.
Rife's proposal to allow BPF programs to iterate over all network namespaces at once could simplify the process, but it still includes some overhead.
Written by urgent.news from LWN's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
