News › performance
By Zayden R., September 15, 2026
Engineers Nathan Naveen and his brother have slashed eBPF CPU costs by 90% through memoization. By caching inode policies, they avoid repetitive path checks, significantly boosting performance. The project is now open source on GitHub.
Engineers Nathan Naveen and his brother have discovered a method to drastically cut the CPU cost of their eBPF security agent by about 90% using memoization. This breakthrough comes from profiling their code and realizing that enforcing policies wasn't the main bottleneck. Instead, determining which policy applied to a given file open was the real resource hog.
Their protection mechanism uses path-based policies, leveraging an LSM hook that triggers on file open. The process involves reconstructing the file path, walking up parent dentries, and checking for matching policies. While effective, this method was inefficient, particularly for files accessed repeatedly or within the same directory subtree. This inefficiency was especially noticeable in database operations, such as with PostgreSQL, where multiple file accesses might occur within a single directory.
To tackle this, they implemented a caching system that stores the policy applicable to each inode. This approach avoids redundant path walking and policy checking for files that have already been processed, significantly reducing kernel CPU usage.
Importantly, the cache design needed to be lightweight and safe. They considered using dentries, but due to the limitations of storing pointers in eBPF maps, they opted for an inode-based cache instead. The cache key comprises three fields: the mount namespace ID, the mount point, and the inode number, allowing for efficient and reliable caching.
For those interested in exploring or contributing to this project, the brothers have open-sourced their repository. The code and further details are available on GitHub at https://github.com/bomfather/agent. This development is a solid improvement for anyone working with eBPF security agents, offering a practical solution to enhance performance without extensive code rewrites.