Skip to content

fix: require kernel 5.8, the first with BPF ring buffers - #363

Merged
mayankpande88 merged 2 commits into
mainfrom
fix/min-kernel-5.8
Oct 6, 2026
Merged

mayankpande88 merged 2 commits into
mainfrom
fix/min-kernel-5.8

Conversation

@mayankpande88

Copy link
Copy Markdown
Contributor

Summary

L7 events go through a BPF ring buffer (BPF_MAP_TYPE_RINGBUF), which every program variant uses. Kernels before 5.8 don't have one. The startup check still accepted kernels from 4.16, so on 4.16–5.7 the agent got past it, initialized, and then failed loading the programs with map l7_events: map create: invalid argument. The README gave 5.1 as the minimum.

The check and the README now say 5.8, and the error names the reason.

Engineering detail
  • The 4.16, 4.20 and 5.6 program variants all contain the ring buffer map, so none of them loads below 5.8.
  • The variant named "5.6" is the one kernels 5.8–5.11 use, so it stays. Removing the 4.16 and 4.20 variants from the bundle would shrink the binary; that's left for a separate change.

Local e2e: built the agent from this branch and from main against glibc 2.31 and ran both on a 5.4 kernel VM (Ubuntu 20.04, arm64). main: passed the version check, initialized for 4s, then failed to load collection: map l7_events: map create: invalid argument. This branch: exits at once with the minimum Linux kernel version required is 5.8 or later (BPF ring buffer). On a 6.1 kernel VM this branch starts normally and serves its metrics.

L7 events go through a BPF ring buffer, which every program variant
uses. The startup check still accepted kernels from 4.16, so on 4.16-5.7
the agent got past it and failed later, loading the programs, with a
less clear error. The README said 5.1.

The check and the README now say 5.8.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the minimum required Linux kernel version from 4.16 to 5.8 in main.go and from 5.1 to 5.8 in README.md. This change is necessary because L7 events now utilize a BPF ring buffer (BPF_MAP_TYPE_RINGBUF), which is unsupported on kernels older than 5.8. I have no feedback to provide.

@mayankpande88
mayankpande88 merged commit 9f28937 into main Oct 6, 2026
7 checks passed
@mayankpande88
mayankpande88 deleted the fix/min-kernel-5.8 branch October 6, 2026 07:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants