research(ebpf): prototype Linux eBPF ingress telemetry integration

Overview

Explore adding an experimental Linux eBPF-based telemetry layer for FaultPlane.

The current runtime collects connection information from user-space components.
This research task investigates whether kernel-level networking signals can improve runtime visibility and failure detection.

Proposed Work

Implement an experimental eBPF integration:

• Add an eBPF prototype under experimental/ebpf/
• Create a minimal C-based eBPF program
• Add a Go loader using github.com/cilium/ebpf
• Document supported Linux kernel requirements
• Keep the feature isolated from the stable runtime

Expected Outcome

A working prototype capable of:

• Attaching an eBPF program
• Receiving kernel networking events
• Exporting events into FaultPlane telemetry

Scope

This is a research feature.

The goal is not to replace the current gateway implementation, but to evaluate future kernel-level observability capabilities.

References

Related areas:

• Linux eBPF
• XDP
• Kernel networking telemetry
• cilium/ebpf

Start in experimental/ebpf/ and review the cilium/ebpf integration approach, along with the current user-space connection telemetry. Define the minimal C eBPF program and Go loader while keeping them isolated from the stable runtime. Done means the prototype attaches, receives kernel networking events, exports them into FaultPlane telemetry, and documents supported Linux kernel requirements.