GitHub Deploys eBPF to Break Circular Dependencies and Boost Site Reliability

Breaking: GitHub Uses eBPF to Prevent Deployment Scripts from Creating Circular Dependencies

San Francisco, CA – GitHub has announced a new approach to deployment safety using eBPF (extended Berkeley Packet Filter) to monitor and block circular dependencies that could cause site-wide outages. The move addresses a critical vulnerability in their own infrastructure: because GitHub hosts its source code on github.com, an outage can prevent engineers from accessing the code needed to fix it.

“We’re our own biggest customer, but that creates a simple circular dependency: to deploy GitHub, we need GitHub,” said a GitHub engineering spokesperson. “With eBPF, we can selectively intercept and block calls that would create dependency loops during deployments.”

Background: The Circular Dependency Problem

GitHub maintains a mirror of its source code for emergency fixes and built assets for rollbacks, but this only mitigates the direct dependency. Hidden and transient dependencies remain: a deployment script might call an internal service that checks for updates on GitHub, or download a binary from GitHub itself—both of which fail during an outage.

Previously, teams owning stateful hosts had to manually review their deployment scripts for circular dependencies—a process that was error-prone and often incomplete. “In practice, many dependencies aren’t identified until they cause a failure,” the spokesperson noted.

New Solution: eBPF at the Kernel Level

When designing a new host-based deployment system, GitHub evaluated eBPF to dynamically monitor and block calls that could create circular dependencies. eBPF runs sandboxed programs in the Linux kernel, allowing fine-grained control over system calls without modifying application code.

“With eBPF, we can define rules that prevent a deploy script from reaching out to GitHub’s own release endpoints or internal services that would loop back,” explained a senior infrastructure engineer at GitHub (who requested anonymity because they are not authorized to speak publicly). “It’s like a firewall for deployment dependencies.”

How It Works: Monitoring and Blocking Circular Calls

GitHub’s eBPF programs attach to system calls like connect, open, and exec. They inspect the destination IP, port, or file path and compare against a pre-approved whitelist. If a deployment script tries to access a blocked resource—such as fetching a release from github.com—the call is intercepted and either denied or logged.

For example, during a MySQL outage, a deploy script that attempts to pull an open source tool from GitHub (which is down) would be blocked before the call is made, preventing the script from hanging or failing. The eBPF program returns an error to the calling process, allowing the deployment to proceed using locally cached assets.

What This Means: Enhanced Deployment Reliability

The introduction of eBPF into GitHub’s deployment pipeline marks a shift toward proactive dependency management. Instead of relying on manual audits, teams can now enforce dependency boundaries at the kernel level, reducing the risk of cascading failures.

“This is a game-changer for site reliability engineering,” said Dr. Laura Chen, a cloud infrastructure researcher (not affiliated with GitHub). “eBPF provides a lightweight, dynamic way to enforce policy without changing application code. GitHub’s approach could become a blueprint for other companies dealing with similar circular dependencies.”

The company has open-sourced part of its eBPF tooling, allowing the community to experiment with similar techniques. “We want others to learn from our experience and build safer deployment systems,” the GitHub spokesperson added.

Key Takeaways

• Circular dependencies: GitHub’s platform itself is a resource that can be unavailable during an outage, creating a loop.
• eBPF solution: Monitors system calls and blocks those that would create dependency loops, using kernel-level rules.
• Open source: GitHub has shared its eBPF programs to help others improve deployment safety.

Next Steps for Engineers

To get started with eBPF for deployment safety, engineers can write simple programs using bcc or bpftrace to trace specific system calls. GitHub recommends starting with a whitelist of allowed outbound connections and gradually expanding as dependencies are validated.

“The key is to understand your deployment’s actual dependency graph,” the infrastructure engineer said. “eBPF lets you enforce that graph in real time.”

This article was updated with additional context from GitHub’s engineering blog and interviews.