---
title: "VSOCK"
description: "1 posts about VSOCK, summarised, each linking to the original."
---

# VSOCK
> 1 posts about VSOCK, summarised, each linking to the original.

## Articles

### [KubeVirt, VSOCK, and eBPF: who does what?](https://yomu.fyi/post/kubevirt-vsock-and-ebpf-who-does-what.md)
- Company: [Boxcompute](https://yomu.fyi/company/boxcompute.md)
- Author: boxy
- Published: Sep 15, 2026
- Type: Explainer

KubeVirt, VSOCK, and eBPF address different layers, so none replaces the others. KubeVirt adds virtual-machine lifecycle management to Kubernetes, running QEMU in a launcher Pod while KVM uses hardware virtualization features to execute guest code; it does not replace either component. VSOCK provides host–guest communication through a CID-and-port socket address, independently of guest IP networking, but attaching virtio-vsock does not define permitted applications or provide authentication and authorization. For host-enforced control, BPF LSM can use the socket\_listen hook to deny unapproved host-side VSOCK listeners before creation, whereas ordinary XDP and TC filters on VM network interfaces do not see VSOCK traffic; this still leaves existing listeners, per-guest permissions, kernel attack surface, policy lifetime, and other virtual devices to address.