Skip to main content

Complete lifecycle management of eBPF programs in the kernel

Explore L3AF WikiTry it!




Industry-first "Kernel Functions as a Service"

L3AF is an industry-first platform for distributed management and composition of eBPF programs. Composition in L3AF means multiple independent eBPF programs can be dynamically combined or “chained” together to solve unique business problems. In the L3AF ecosystem, we refer to eBPF programs as “Kernel Functions” because they extend the functionality of the OS kernel. These features combine to make L3AF a platform that provides “Kernel Functions as a Service.”

Multiple independent kernel functions executing in a chain

“Chaining” in L3AF means that the Kernel Functions can be configured to run sequentially as configured by the user. Kernel Functions can be reordered on the fly according to business needs. Chaining is a powerful feature that enables the composition of multiple, independent eBPF programs in order to solve unique problems.

More to come, including a community-driven kernel function marketplace

We believe that eBPF users can benefit from the modular development and open distribution of eBPF programs. In this respect, we embrace the Unix philosophy of “write programs that do one thing and do it well.” Our vision is that the L3AF team, open-source community, and other businesses will develop independent eBPF programs that will be shared in a “kernel function marketplace.” Users can then download a selection of signed eBPF programs and orchestrate them to solve their unique business needs.

Simple API to add, remove, and reorder kernel functions on the fly

Kernel functions may store metrics in eBPF maps. L3AF can be configured to read these metrics and expose them over a web API.

Configurable metrics are gathered for each kernel function

Kernel functions may store metrics in eBPF maps. L3AF can be configured to read these metrics and expose them over a web API.

Replace proprietary applications and hardware with blazing fast eBPF code

L3AF empowers its users to remove expensive hardware appliances with software-defined networking in the form of eBPF programs. L3AF is currently being used in production to save money and reduce network hops. Real-world examples include the removal of commercial networking packets broker and hardware load balancer solutions.

Distributed model to manage and configure kernel functions on a per-node basis

A L3AF daemon (L3AFD) runs on each machine and exposes a simple web API for configuration. This offers great flexibility in that each machine is able to have a unique configuration if the user wishes.

Compose kernel functions to fit business needs

L3AF is designed to combine multiple, individual kernel functions into a comprehensive and complementary solution to business problems. Even individual kernel functions can be configured differently depending on their environment. This composition and configurability of eBPF programs provide great flexibility to the user.

Cloud and vendor agnostic

L3AF can be run on any Linux system (>= 4.18). This means L3AF can be leveraged to solve common problems that may exist between cloud environments where other common solutions may not exist.

L3AF: Platform

KF Marketplace

Coming Soon!

L3AF: Vision

At L3AF, our vision is to create a marketplace for eBPF programs (Kernel Functions), where users and developers can share their own signed kernel functions and download kernel functions from others. Our L3AF platform can then be used to orchestrate and compose selected kernel functions from the marketplace to several business needs. In this way, L3AF provides developers with a cloud and vendor-agnostic platform for adding capabilities to an operating system at runtime. We believe that the creation of such a fully integrated software ecosystem around eBPF will unleash its full potential for community adoption.

Latest Posts

November 14, 2022 in Blog

L3AF v1 – the first major release since open source!

L3AF v 1.0.0 is now available on GitHub - the first major release of l3afd since open source! All eBPF programs in the L3AF package repository should work on Linux (kernel 5.1…
Read More
February 9, 2022 in Blog

Introducing L3AF, a Platform to Launch and Manage eBPF Programs – Karan Dalal & Brian Merrell

Read More

eBPF Summit 2021 Presentations

High Performance Load Balancing at Walmart
Karan Dalal and Kanthi Pavuluri, Walmart

Running and Orchestrating Multiple XDP and TC Programs
Brian G. Merrell, Walmart