eBPF CPU cost reduction via memoization raises memory and invalidation concerns
Problem
High CPU cost of repeatedly opening the same files in eBPF programs; caching can cut cost by ~90% but introduces memory overhead and complex invalidation logic.
Pain points
- The claimed 90% CPU reduction may only apply to specific workloads
- Memory overhead of the cache
- Cache invalidation challenges due to permission changes, directory moves, hard-links, and deletions
- Cache size limits
- Handling of bind mounts and alternative path representations
Questions to verify
- Can the 90% CPU reduction be reproduced on workloads that do not involve repeatedly opening the same file?
- What is the expected memory overhead of the cache, and is there a size limit?
- How will the cache handle invalidation events such as permission changes, directory moves, or deletions?
Evidence
quote
Memoization trades compute time for memory: you reduce CPU cost by 90% _at the cost_ of some memory. The author measured one, but it doesn't look like they measured the other.
quote
Seems like the 90% faster case is opening the same exact file every single time, which seems like a not super standard use case that will benefit the most from this caching.
quote
How is the cache invalidated when: The permissions change? Directories are moved? Hard-links are added? Things are deleted?
quote
How do your path-only rules handle the many approaches for loading a file but making it appear to have a different path, such as bind mounts for one example?
quote
Simple memoization yields massive wins. Had similar experience with a hot loop, sometimes the basics are just magic.
Disclaimer: this card is distilled by AI from community discussions as “pain point evidence”. It is a starting point for need analysis and validation, not a “validated market need”. AI has analytical limits; please open the original discussion above to manually verify before key decisions.