Wasm-bpf: Streamlining eBPF Deployment in Cloud Environments with WebAssembly

TL;DR

The paper tackles the challenge of deploying eBPF programs across heterogeneous cloud environments with kernel, OS, runtime, and architecture diversity. It introduces Wasm-bpf, a lightweight WebAssembly/WASI-based runtime that provides arch-aware relocation, automatic runtime selection, and tight container-toolchain integration, enabling eBPF and control-plane programs to be packaged as Wasm modules. Key contributions include cross-platform compatibility, reduced deployment overhead, and a modular plugin model via Wasm OCI images and a standardized ABI. The evaluation shows Wasm-bpf achieves minimal overhead relative to native eBPF, faster startup and smaller image sizes than container-based deployments, and broad cross-platform compatibility, indicating substantial practical impact for scalable observability in cloud environments.

Abstract

The extended Berkeley Packet Filter (eBPF) is extensively utilized for observability and performance analysis in cloud-native environments. However, deploying eBPF programs across a heterogeneous cloud environment presents challenges, including compatibility issues across different kernel versions, operating systems, runtimes, and architectures. Traditional deployment methods, such as standalone containers or tightly integrated core applications, are cumbersome and inefficient, particularly when dynamic plugin management is required. To address these challenges, we introduce Wasm-bpf, a lightweight runtime on WebAssembly and the WebAssembly System Interface (WASI). Leveraging Wasm platform independence and WASI standardized system interface, with enhanced relocation for different architectures, Wasm-bpf ensures cross-platform compatibility for eBPF programs. It simplifies deployment by integrating with container toolchains, allowing eBPF programs to be packaged as Wasm modules that can be easily managed within cloud environments. Additionally, Wasm-bpf supports dynamic plugin management in WebAssembly. Our implementation and evaluation demonstrate that Wasm-bpf introduces minimal overhead compared to native eBPF implementations while simplifying the deployment process.

Figures (2)

• Figure 1: The runtime of Wasm-bpf
• Figure 2: Wasm-bpf's ABI design