How GitHub uses eBPF to improve deployment safety

Summary

Deployment scripts can introduce dangerous circular dependencies when they rely on services or assets from platforms that are currently experiencing outages. Blocking network access at the host level is impractical because stateful nodes continue serving live traffic during rolling deployments. To solve this, GitHub isolates deploy scripts into dedicated Linux cGroups and attaches custom eBPF programs via the cilium/ebpf Go library. The system uses socket-address hooks to redirect DNS queries to a userspace proxy that checks a domain blocklist, while egress packet hooks map DNS transaction IDs to process IDs. This approach successfully prevents deploy-time circular dependencies, provides full command-line audit logs for blocked requests, and speeds up incident recovery.

Takeaways

1. 1

   Using BPF_PROG_TYPE_CGROUP_SOCK_ADDR enables rewriting connect4 syscalls on port 53 to route cGroup DNS queries to a local userspace proxy.

2. 2

   Correlating skb_buff DNS transaction IDs with process IDs in eBPF maps allows looking up /proc/{PID}/cmdline to identify the exact command triggering a blocked request.

3. 3

   Placing deploy scripts in dedicated cGroups allows applying network egress blocklists without impacting the host's primary production traffic.