iovisor

iovisor iovisor is an open-source initiative focused on advanced kernel-level observability and programmable data plane tooling for modern Linux systems. It provides projects and libraries that enable developers and operators to instrument, monitor, and control networking and security stacks in production environments such as Google-scale datacenters, Netflix delivery platforms, and Facebook infrastructure. The project interfaces with a broad ecosystem including cloud platforms like Amazon Web Services, Microsoft Azure, and Google Cloud Platform, and attracts contributors from enterprises such as Intel Corporation, Red Hat, and Cisco Systems.

Overview

iovisor produces a set of tools and libraries centered on extended Berkeley Packet Filter (eBPF) and kernel tracing technologies such as kprobe and tracepoint that interact with the Linux kernel networking and observability subsystems. Core deliverables include the bcc toolkit, the libbpf library, and a collection of eBPF programs and examples used by operators at Uber, LinkedIn, Twitter, and Square for latency diagnosis and packet filtering. The initiative complements other projects like Cilium and BPF Compiler Collection while integrating with observability stacks including Prometheus, Grafana, Jaeger, and Fluentd. iovisor’s components are used alongside orchestration systems such as Kubernetes and service mesh technologies like Istio.

History and Development

The project originated from work by kernel engineers including Alexei Starovoitov and Thomas Graf who contributed to eBPF advancements within the Linux kernel community and companies like Facebook and Intel Corporation. Early efforts built upon research from academic groups at institutions such as University of California, Berkeley, MIT, and ETH Zurich and incorporated contributions from open-source organizations like The Linux Foundation. Over time, governance and roadmap discussions involved stakeholders from Red Hat, Google, Microsoft, and independent contributors active in events like Open Source Summit and KubeCon. Releases and feature milestones were announced at conferences including FOSDEM, USENIX, and LinuxCon.

Technology and Components

iovisor’s stack leverages several interrelated projects. The bcc (BPF Compiler Collection) project provides Python and Lua frontends to compile and load eBPF bytecode into the Linux kernel using interfaces standardized by kernel maintainers including Linus Torvalds and subsystem maintainers like Alexei Starovoitov. The libbpf library offers a C-level API for interacting with eBPF programs and maps, enabling integration with system components developed by companies such as Red Hat and Intel Corporation. Tools such as bpftool facilitate inspection of loaded programs and maps, and integrate with debugging and tracing utilities like perf and SystemTap. iovisor components interoperate with user-space observability frameworks such as OpenTracing and OpenTelemetry and with networking dataplane projects including DPDK and XDP for high-performance packet processing.

Use Cases and Deployments

Operators and developers deploy iovisor tooling for real-time packet inspection, latency profiling, and security enforcement. Large-scale adopters include content delivery platforms like Netflix and Akamai, ride-sharing companies like Uber and Lyft, and social networks including Twitter and LinkedIn for in-band telemetry, flow monitoring, and DDoS mitigation. Integration patterns involve cloud providers such as Amazon Web Services and Google Cloud Platform where eBPF-based observability augments virtual networking stacks managed by OpenStack or Kubernetes. Security teams at enterprises like Cisco Systems and Palo Alto Networks use eBPF programs for host-based intrusion detection and syscall filtering alongside policy engines like SELinux and AppArmor.

Community and Governance

iovisor development is driven by a mix of corporate contributors, independent maintainers, and academic collaborators, with coordination through mailing lists, code repositories hosted on platforms like GitHub, and meetings at community conferences such as KubeCon and Open Source Summit. Governance involves maintainers who review patches, manage releases, and liaise with the Linux kernel community and other projects such as Cilium and Grafana Labs. Funding and sponsorship have come from companies like Intel Corporation, Google, Microsoft, and Red Hat, while contributors include engineers formerly associated with Facebook, Netflix, and Uber. The community engages through working groups, technical calls, and contributor summits often held near major events like Linux Foundation gatherings.

Category:Linux software Category:Open-source projects Category:Networking software