eBPF & Live Migration Architecture
Deep dive into kernel-level eBPF packet processing, VPC network isolation, and zero-downtime TCP session migration.
Kernel-Level eBPF Subsystem
The microsrv cloud engine uses the Linux kernel’s eBPF (Extended Berkeley Packet Filter) subsystem for high-throughput packet filtering, VPC tenant isolation, and routing, bypassing traditional iptables and netfilter overhead.
Key Engineering Advantages of eBPF:
- Line-Rate IP Anti-Spoofing: eBPF programs validate IP/MAC address tuples directly on virtual network interfaces, preventing packet interception or spoofing between co-located tenant VMs.
- Zero-Copy Outbound NAT: Source address translation (SNAT) occurs natively within the kernel network stack, avoiding expensive context switching to user-space daemons.
Live Migration Subsystem
1. EVICTION TELEMETRY DETECTED
[TELEMETRY] Provider reclaim signal received (T-120s) • Reserving standby capacity on Host B...
Execution Lifecycle:
- Eviction Signal Telemetry: The microsrv orchestrator monitors provider hardware and API telemetry to detect impending host reclamation.
- Iterative Pre-copy Phase: The bulk of VM or container sandbox memory pages is asynchronously streamed to the target host while guest applications remain fully operational.
- Cutover Phase: CPU execution is briefly suspended for under 50 ms, transferring the final dirty pages, CPU register state, and NVMe disk leases.
- Atomic eBPF Re-routing: eBPF socket maps across ingress gateways and mesh routers are updated atomically. External TCP connections remain established without socket resets.
[!NOTE] Workloads relying on long-lived TCP sessions (gRPC streams, WebSockets, database connection pools) maintain state throughout host migration events on both VMs and Containers.