{
  "id": 7456394,
  "title": "Dropping eBPF CPU Cost by About 90% with Memoization (Not AI Gen)",
  "url": "https://urgent.news/2026/09/14/dropping-ebpf-cpu-cost-by-about-90-with-memoization-not-ai-gen",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-14T14:29:23.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://nathannaveen.dev/posts/dropping-ebpf-cpu-cost-by-90/"
  },
  "original_language": "en",
  "account": "A security agent designed for eBPF was initially fast, but a recent discovery revealed an opportunity to boost its performance even further. After profiling the code, it was found that the most resource-intensive part wasn't the policy enforcement itself, but determining which policy applied to a specific file open. The policy-based nature of the eBPF system required reconstructing the file path, traversing parent directories, and checking if the file or any ancestor directory matched a policy. This process, while functional, proved to be inefficient, resulting in repeated work for files already processed. To address this, the team implemented a caching mechanism, which led to a significant reduction in kernel CPU cost by about 90%. By caching the policies associated with each inode, the team managed to minimize the need to traverse the entire path each time a file was accessed. This innovation, described in a blog post available at https://github.com/bomfather/agent, involved using the inode number as the cache key, alongside the mount namespace ID and mount ID to ensure accurate and safe cache usage. The caching strategy effectively eliminated the \"slow path\" by reducing the number of kernel cycles required for file open operations from 28 billion to a mere 3.03 billion. This development not only improved the efficiency of the eBPF security agent but also demonstrated the value of thoughtful caching strategies in optimizing system performance.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}