Skip to main content
FOSDEM PWA

BPF Tokens in Linux Distributions: A Path to Safe User-Space eBPF

H.1308 (Rolin) | Day 1 | 18:30 - 19:00 | Speakers: Daniel Mellado

BPF Tokens in Linux Distributions: A Path to Safe User-Space eBPF
A picture of a devroom at FOSDEM 2024
Open in browser
Get involved in the conversation!Join the chat

Notes

Abstract

BPF Tokens are a new Linux kernel mechanism for delegating restricted eBPF privileges to unprivileged processes. This talk explains how distributions can adopt them to provide safer access to tracing, observability, and networking tools—without granting root or CAP_SYS_ADMIN.

We’ll show how token-based delegation could reshape developer workflows, container runtimes, and system services in Fedora or other distros.

The session includes a walkthrough of real token policies and discusses how distributions can help build a secure, less-privileged eBPF ecosystem.

Speakers

Daniel Mellado

I’m Daniel Mellado, a Principal Software Engineer at Red Hat. My work spans cloud-native networking, Kubernetes, Edge, and OpenShift Observability, where I contribute to the Cloud Monitoring Operator (CMO), Prometheus, Perses, and the Cluster Observability Operator (COO).

In the OpenStack community, I’ve served as a Project Team Lead (PTL) and as a Cross-Project Liaison for Kuryr. I contributed extensively to Kuryr-Kubernetes and its integration with OpenStack Neutron, helping bridge the Kubernetes and OpenStack ecosystems. My work is referenced in the “Leveraging Containers and OpenStack” use-case whitepaper, and I’ve spoken at OpenStack Summits on Kuryr onboarding, hybrid workload networking, and Kubernetes interoperability. I’ve also contributed to upstream networking efforts such as MetalLB.

I’ve been involved with the Kubernetes–OpenStack Special Interest Group (SIG), participating in early efforts to improve interoperability and cross-project collaboration between both communities.

In Fedora, I founded the eBPF SIG, where I focus on packaging and maintaining eBPF tooling. I’m currently working on packaging AYA, improving Rust vendoring workflows, and collaborating on enhancements to rust2rpm to better support Rust-based projects in Fedora.

I’m also a frequent speaker at FOSDEM, DevConf, and ConfigMgmtCamp, sharing insights on cloud-native networking, observability, eBPF, and upstream collaboration. Currently trying to organize Fedora community and Distributions Devrrom for the upcoming FOSDEM XD

Outside of tech… I like to think I’m a pretty great bass player. 😄

Notice: The placeholder video image is licensed under CC BY-SA 4.0. The original image can be found hereChanges made to the image are: Cropped the image to a new ratio, part of the image was cut off.