# How GitHub uses eBPF to improve deployment safety

[Github](https://yomu.fyi/company/github) · Lawrence Gripper · Apr 16, 2026

**Type:** Problem & solution

## Summary

Deployment scripts can introduce dangerous circular dependencies when they rely on services or assets from platforms that are currently experiencing outages. Blocking network access at the host level is impractical because stateful nodes continue serving live traffic during rolling deployments. To solve this, GitHub isolates deploy scripts into dedicated Linux cGroups and attaches custom eBPF programs via the cilium/ebpf Go library. The system uses socket-address hooks to redirect DNS queries to a userspace proxy that checks a domain blocklist, while egress packet hooks map DNS transaction IDs to process IDs. This approach successfully prevents deploy-time circular dependencies, provides full command-line audit logs for blocked requests, and speeds up incident recovery.

## Context

Deployment scripts executing on stateful production nodes risked failing during incidents due to circular dependencies on GitHub, but completely blocking host-level network access would break live customer traffic.

## Approach / What changed

GitHub isolated deployment scripts within Linux cGroups and applied eBPF programs (BPF\_PROG\_TYPE\_CGROUP\_SOCK\_ADDR and BPF\_PROG\_TYPE\_CGROUP\_SKB) alongside a userspace DNS proxy to intercept, filter, and audit outbound domain requests per process.

## Takeaways

- Using BPF\_PROG\_TYPE\_CGROUP\_SOCK\_ADDR enables rewriting connect4 syscalls on port 53 to route cGroup DNS queries to a local userspace proxy.
- Correlating skb\_buff DNS transaction IDs with process IDs in eBPF maps allows looking up /proc/{PID}/cmdline to identify the exact command triggering a blocked request.
- Placing deploy scripts in dedicated cGroups allows applying network egress blocklists without impacting the host's primary production traffic.

**Tags:** [Deployment](https://yomu.fyi/topic/deployment), [Go](https://yomu.fyi/topic/go), [Incident Response](https://yomu.fyi/topic/incident-response), [Observability](https://yomu.fyi/topic/observability), [Reliability](https://yomu.fyi/topic/reliability)

[Read original post](https://github.blog/engineering/infrastructure/how-github-uses-ebpf-to-improve-deployment-safety)