Speeding up eBPF filepath checks

Wed, 28 Oct 2026 14:42:00 -0500

Recently, I was testing our eBPF agent, and I found a major bottleneck in our code. My brother Nathan solved half the problem by caching the results. This blog post covers how we speed up the limiting factor itself, filepath checking, even when we don’t have cached results.

Before we dive into the performance changes, I want to briefly explain what our eBPF agent does so everything makes sense. Essentially, the eBPF agent receives a list of protected directories, if someone tries to mutate any files under those directories, we apply our policy. This is a gross simplification, so for a more in-depth one, take a look at the bomfather/agent README.

Ebpf on Neil Naveen

Speeding up eBPF filepath checks