How we found a bug in Go's arm64 compiler
2025-10-08
84 million requests a second means even rare bugs appear often. We'll reveal how we discovered a race condition in the Go arm64 compiler and got it fixed....
Programming
QUIC restarts, slow problems: udpgrm to the rescue
2025-05-07
udpgrm is a lightweight daemon for graceful restarts of UDP servers. It leverages SO_REUSEPORT and eBPF to route new and existing flows to the correct server instance....
How to execute an object file: part 4, AArch64 edition
2023-11-17
The initial posts are dedicated to the x86 architecture. Since then, the fleet of our working machines has expanded to include a large and growing number of ARM CPUs. This time we’ll repeat this exercise for the aarch64 architecture....
Live-patching security vulnerabilities inside the Linux kernel with eBPF Linux Security Module
2022-06-29
Learn how to patch Linux security vulnerabilities without rebooting the hardware and how to tighten the security of your Linux operating system with eBPF Linux Security Module...
How to execute an object file: Part 3
2021-09-10
Continue learning how to import and execute code from an object file. In this part we will handle external library dependencies....
Branch predictor: How many "if"s are too many? Including x86 and M1 benchmarks!
2021-05-06
Is it ok to have if clauses that will basically never be run? Surely, there must be some performance cost to that......
How to execute an object file: Part 2
2021-04-02
Continue learning how to import and execute code from an object file. This time we will investigate ELF relocations....
How to execute an object file: Part 1
2021-03-02
Ever wondered if it is possible to execute an object file without linking? Or use any object file as a library? Follow along to learn how to decompose an object file and import code from it along the way....
Diving into /proc/[pid]/mem
2020-10-27
A few months ago, after reading about Cloudflare doubling its intern class, I quickly dusted off my CV and applied for an internship. Long story short: now, a couple of months later, I found myself staring at Linux kernel code and adding a pretty cool feature to gVisor....
Raking the floods: my intern project using eBPF
2020-09-18
SYN-cookies help mitigating SYN-floods for TCP, but how can we protect services from similar attacks that use UDP? We designed an algorithm and a library to fill this gap, and it’s open source!...
When Bloom filters don't bloom
2020-03-02
Last month finally I had an opportunity to use Bloom filters. I became fascinated with the promise of this data structure, but I quickly realized it had some drawbacks. This blog post is the tale of my brief love affair with Bloom filters....
Join Cloudflare & Moz at our next meetup, Serverless in Seattle!
2019-06-24
Cloudflare is organizing a meetup in Seattle on Tuesday, June 25th and we hope you can join. We’ll be bringing together members of the developers community and Cloudflare users for an evening of discussion about serverless compute and the infinite number of use cases for deploying code at the edge. ...
Inside the Entropy
2019-06-17
Generating random outcomes is an essential part of everyday life; from lottery drawings and constructing competitions, to performing deep cryptographic computations. ...
Building a To-Do List with Workers and KV
2019-05-21
In this tutorial, we’ll build a todo list application in HTML, CSS and JavaScript, with a twist: all the data should be stored inside of the newly-launched Workers KV, and the application itself should be served directly from Cloudflare’s edge network, using Cloudflare Workers....
Workers KV — Cloudflare's distributed database
2019-05-21
Today, we’re excited to announce Workers KV is entering general availability and is ready for production use!...
Cloudflare architecture and how BPF eats the world
2019-05-18
Recently at I gave a short talk titled "Linux at Cloudflare". The talk ended up being mostly about BPF. It seems, no matter the question - BPF is the answer. Here is a transcript of a slightly adjusted version of that talk....
eBPF can't count?!
2019-05-03
It is unlikely we can tell you anything new about the extended Berkeley Packet Filter, eBPF for short, if you've read all the great man pages, docs, guides, and some of our blogs out there. But we can tell you a war story, who doesn't like those? ...
xdpcap: XDP Packet Capture
2019-04-24
Our servers manage heaps of network packets, from legit traffic to big DDoS attacks. For top efficiency, we adopted eXpress Data Path (XDP), a Linux kernel tool for swift, low-level packet handling....
Eating Dogfood at Scale: How We Build Serverless Apps with Workers
2019-04-19
You’ve had a chance to build a Cloudflare Worker. You’ve tried KV Storage and have a great use case for your Worker. You’ve even demonstrated the usefulness to your product or organization. ...
BoringTun, a userspace WireGuard implementation in Rust
2019-03-27
Today we are happy to release the source code of a project we’ve been working on for the past few months. It is called BoringTun, and is a userspace implementation of the WireGuard® protocol written in Rust....
