The existing redirect mode uses XDP to maximize performance but is not suitably
secure: packets are copied directly from the driver into a userspace buffer
(UMEM). But because the UMEM is shared among all processes with a socket open
on a particular NIC queue, sandboxes using redirect mode all map the same UMEM
and thus can read each other's packets.
Tunnel mode instead installs an eBPF program that copies packets from the
host's NIC driver into a per-sandbox NIC driver. This incurs an additional
copy, but there is no longer memory shared between sandboxes.
Benchmarking tunnel mode with redis-benchmark shows a performance gain over
standard Docker networking of 20%. Redirect mode showed a 30% improvement.
PiperOrigin-RevId: 595746162
This just swaps out the fdbased endpoint for an XDP one. Some related
changes in here:
- Moved the AF_XDP BPF program into its own Go package so it can be
shared.
- Added a flag to tcp_benchmark to disable user namespaces. This helps
when running as root, which is required to install BPF programs.
Kevin KrakauerandgVisor bot
Adin ScannellandgVisor bot