A team compares two workload agents for Linux hosts. One relies on long iptables rule chains and periodic log parsing for visibility; the other attaches eBPF programs to kernel hooks. Why is the eBPF-based design generally preferred for visibility and enforcement at scale?
Select an answer to reveal the explanation.
Short Explanation
Long iptables chains are like a bouncer reading a thousand-line list for every guest. eBPF puts small, verified programs right on the kernel's hooks, so it sees events as they happen and decides fast. The trap answers you'll see move work out of the kernel or bring back the risky kernel modules eBPF was meant to avoid.
Full Explanation
eBPF programs attach to kernel hooks for networking, system calls and tracepoints and run in kernel context after the verifier approves them. For visibility, that means process, file and connection events are captured as they occur rather than reconstructed later from logs. For enforcement, eBPF-based data paths can make decisions with efficient map lookups instead of walking long, sequential iptables chains, which grow slower and harder to manage as the number of rules and workloads increases. The result is lower overhead, richer context and better scale, without loading third-party kernel modules. Moving enforcement into a user-space proxy adds context switches and latency and is not what eBPF does; eBPF keeps processing in the kernel. Replacing the host kernel with a microkernel image is unrelated to eBPF, which extends the existing Linux kernel without replacing it. Shipping a version-specific kernel module with no verifier is precisely the model eBPF improves on, since unverified modules run with full privileges and can crash the host. Exam caveat: iptables-based enforcement still works and is common, so the blueprint point is why eBPF scales better, not that iptables is obsolete. Operational check: compare CPU overhead and rule-update times for both agents under a realistic workload, and confirm the eBPF agent loads without any out-of-tree modules.