https://luth.io/tags/ebpf/ Recent content in Ebpf on Luther Monson Hugo en Fri, 28 Aug 2026 20:40:00 -0700 https://luth.io/blog/2026/08/ephpm-ebpf-per-vhost-network-policy/ Fri, 28 Aug 2026 20:40:00 -0700 https://luth.io/blog/2026/08/ephpm-ebpf-per-vhost-network-policy/ <p>In multi-tenant mode <a href="https://github.com/ephpm/ephpm">ePHPm</a> serves every site in <code>sites_dir</code> from one process. Every tenant&rsquo;s PHP runs as the same OS user on the same pool of ZTS threads. A thread that just served <code>blog.example</code> will serve <code>shop.example</code> a few milliseconds later. That&rsquo;s the density win. It also means the kernel has no idea which tenant is behind a given <code>connect()</code>. As far as Linux is concerned it&rsquo;s all <code>ephpm-web</code>.</p> <p>Most of the isolation work in ePHPm happens above the kernel. That covers <code>open_basedir</code>, the function denylist, per-site databases and KV keyspaces. Network is the one place where that isn&rsquo;t enough. This week we brought eBPF in to give the kernel a per-tenant identity. It went from a roadmap doc on Wednesday morning to merged that evening (<a href="https://github.com/ephpm/ephpm/pull/413">#413</a>, aimed at v0.8.1). v0.8.1 never got a release because its Linux legs failed to link. v0.8.2 shipped with the BPF object silently stubbed out. v0.8.3 was the first release that carried it. This post covers what it enforces and what it costs. It also covers what broke on the way out the door and what it doesn&rsquo;t do.</p>