tricorder-observability / Starship

Starship: next-generation Observability platform built with eBPF+WASM
GNU Affero General Public License v3.0
163 stars 23 forks source link

[RFC] Module distribution mechanism and tooling #68

Open nascentcore-eng opened 1 year ago

nascentcore-eng commented 1 year ago

Is your feature request related to a problem? Please describe. eBPF+WASM module is written by Starship end users. The learning curve of writing eBPF+WASM needs to be minimal, and the binary format needs to be easy to distribute and use.

This mechanism needs to have 2 parts:

Describe the solution you'd like Not sure

This is an exploratory task, needs brain store.

Describe alternatives you've considered

Additional context https://github.com/tricorder-observability/Starship/issues/250

yunwei37 commented 1 year ago

The distribution approach of wasm-bpf is the same as most libbpf, cilium/ebpf programs, except in wasm executable file instead of native elf executable file. you can distribute the wasm binary what ever you want.

The distribut approach in eunomia-bpf also nearly the same as what bumblebee does, but in wasm module instead of native share libraries. Because wasm has It's own OCI image types, there is no need to create another type.

see https://github.com/eunomia-bpf/wasm-bpf and https://github.com/eunomia-bpf/eunomia-bpf/tree/master/ecli

nascentcore-eng commented 1 year ago

Bumblebee's OCI image has to be executed by bumblebee CLI, not by docker.

Eunomia-bpf's wasm exported pre-defined public functions, and ecc CLI needs to call these functions. JSON -> header file, included in wasm guest code, and compile into .wasm object file.

https://github.com/eunomia-bpf/wasm-bpf bpftool, libbpf https://github.com/eunomia-bpf/wasm-bpf/tree/main/examples/bootstrap#the-compile-process-of-the-bootstrapwasm Wasm includes ebpf byte code.

eunomia-bpf JSON, ecc can dynamic load ebpf program object file, and minimal set of BTF file, BTF consumes 10s of MB disk size.