<commit_before><img src="https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/logo.svg" alt="Cilium Logo" width="350" />

[![Build Status](https://jenkins.cilium.io/job/cilium/job/cilium/job/master/badge/icon)](https://jenkins.cilium.io/job/cilium/job/cilium/job/master/)
[![Go Report Card](https://goreportcard.com/badge/github.com/cilium/cilium)](https://goreportcard.com/report/github.com/cilium/cilium)
[![GoDoc](https://godoc.org/github.com/cilium/cilium?status.svg)](https://godoc.org/github.com/cilium/cilium)
[![Read the Docs](https://readthedocs.org/projects/docs/badge/?version=latest)](http://cilium.readthedocs.io/en/latest/)
[![Apache licensed](https://img.shields.io/badge/license-Apache-blue.svg)](https://github.com/cilium/cilium/blob/master/LICENSE)
[![GPL licensed](https://img.shields.io/badge/license-GPL-blue.svg)](https://github.com/cilium/cilium/blob/master/bpf/COPYING)
[![Join the Cilium slack channel](https://cilium.herokuapp.com/badge.svg)](https://cilium.herokuapp.com/)

Cilium is open source software for providing and transparently securing the
network connectivity between application services deployed using Linux
container management platforms like Docker and Kubernetes.

At the foundation of Cilium is a new Linux kernel technology called eBPF, which
enables the dynamic insertion of BPF bytecode into the Linux kernel. Cilium
generates individual BPF programs for each container to provide networking,
security and visibility.

<p align="center">
   <img src="Documentation/images/cilium-arch.png" />
</p>

## Components:
  * **Cilium Daemon**: Agent written in Go. Generates & compiles the BPF
    programs, manages the BPF maps, and interacts with the local container
    runtime.
  * **BPF programs**:
    * **container**: Container connectivity & security policies
    * **netdev**: Integration with L3 networks (physical/virtual)
    * **overlay**: Integration with overlay networks (VXLAN, Geneve)
    * **load balancer**: Fast L3/L4 load balancer with direct server return.
  * **Integrations**
    * **networking frameworks**: CNI, libnetwork
    * **container runtimes**: Docker
    * **orchestration systems**: Kubernetes
    * **logging**: logstash
    * **monitoring**:

## Getting Started

 * [Why Cilium?](http://docs.cilium.io/en/latest/intro/#why-cilium)
 * [Getting Started Guide with Vagrant](http://docs.cilium.io/en/latest/gettingstarted/)
 * [Architecture](http://docs.cilium.io/en/latest/architecture/)
 * [Administrator Guide](http://docs.cilium.io/en/latest/admin/)
 * [Frequently Asked Questions](https://github.com/cilium/cilium/issues?utf8=%E2%9C%93&q=is%3Aissue%20label%3Aquestion%20)
 * [Contributing](http://docs.cilium.io/en/latest/contributing)

## What is eBPF and XDP?

Berkeley Packet Filter (BPF) is a Linux kernel bytecode interpreter originally
introduced to filter network packets, e.g. tcpdump and socket filters. It has
since been extended with additional data structures such as hashtable and
arrays as well as additional actions to support packet mangling, forwarding,
encapsulation, etc. An in-kernel verifier ensures that BPF programs are safe to
run and a JIT compiler converts the bytecode to CPU architecture specific
instructions for native execution efficiency. BPF programs can be run at
various hooking points in the kernel such as for incoming packets, outgoing
packets, system calls, kprobes, etc.

BPF continues to evolve and gain additional capabilities with each new Linux
release. Cilium leverages BPF to perform core datapath filtering, mangling,
monitoring and redirection, and requires BPF capabilities that are in any Linux
kernel version 4.8.0 or newer (the latest current stable Linux kernel is
4.10.x).

Linux distros that focus on being a container runtime (e.g., CoreOS, Fedora
Atomic) typically already have default kernels that are newer than 4.8, but
even recent versions of general purpose operating systems, with the exception
of Ubuntu 16.10, are unlikely to have a default kernel that is 4.8+. However,
such OSes should support installing and running an alternative kernel that is
4.8+.

For more detail on kernel versions, see: [Prerequisites](prerequisites)

<p align="center">
   <img src="Documentation/images/bpf-overview.png" width="508" />
</p>

XDP is a further step in evolution and enables to run a specific flavour of
BPF programs from the network driver with direct access to the packet's DMA
buffer.

## Prerequisites

The easiest way to meet the prerequisites is to use the provided vagrant box
which provides all prerequisites in a sandbox environment. Please see the
[vagrant guide](Documentation/vagrant.rst) for more details.

In order to meet the prerequisites for an installation outside of vagrant,
the following components must be installed in at least the version specified:

 * Linux kernel (http://www.kernel.org/)
    * Minimum: >= 4.8.0
    * Recommended: >= 4.9.17. Use of a 4.9.17 kernel or later will ensure
      compatibility with clang > 3.9.x
 * clang+LLVM >=3.7.1. Please note that in order to use clang 3.9.x, the
   kernel version requirement is >= 4.9.17
 * iproute2 >= 4.8.0: https://www.kernel.org/pub/linux/utils/net/iproute2/

Cilium will make use of later kernel versions if available. It will probe
for the availability of the functionality automatically. It is therefore
perfectly acceptable to use a distribution kernel which has the required
functionality backported.

## Installation

See the [Installation instructions][installation]

## Presentations<commit_msg>doc: minor improvements in readme's bpf section<commit_after><img src="https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/logo.svg" alt="Cilium Logo" width="350" />

[![Build Status](https://jenkins.cilium.io/job/cilium/job/cilium/job/master/badge/icon)](https://jenkins.cilium.io/job/cilium/job/cilium/job/master/)
[![Go Report Card](https://goreportcard.com/badge/github.com/cilium/cilium)](https://goreportcard.com/report/github.com/cilium/cilium)
[![GoDoc](https://godoc.org/github.com/cilium/cilium?status.svg)](https://godoc.org/github.com/cilium/cilium)
[![Read the Docs](https://readthedocs.org/projects/docs/badge/?version=latest)](http://cilium.readthedocs.io/en/latest/)
[![Apache licensed](https://img.shields.io/badge/license-Apache-blue.svg)](https://github.com/cilium/cilium/blob/master/LICENSE)
[![GPL licensed](https://img.shields.io/badge/license-GPL-blue.svg)](https://github.com/cilium/cilium/blob/master/bpf/COPYING)
[![Join the Cilium slack channel](https://cilium.herokuapp.com/badge.svg)](https://cilium.herokuapp.com/)

Cilium is open source software for providing and transparently securing the
network connectivity between application services deployed using Linux
container management platforms like Docker and Kubernetes.

At the foundation of Cilium is a new Linux kernel technology called eBPF, which
enables the dynamic insertion of BPF bytecode into the Linux kernel. Cilium
generates individual BPF programs for each container to provide networking,
security and visibility.

<p align="center">
   <img src="Documentation/images/cilium-arch.png" />
</p>

## Components:
  * **Cilium Daemon**: Agent written in Go. Generates & compiles the BPF
    programs, manages the BPF maps, and interacts with the local container
    runtime.
  * **BPF programs**:
    * **container**: Container connectivity & security policies
    * **netdev**: Integration with L3 networks (physical/virtual)
    * **overlay**: Integration with overlay networks (VXLAN, Geneve)
    * **load balancer**: Fast L3/L4 load balancer with direct server return.
  * **Integrations**
    * **networking frameworks**: CNI, libnetwork
    * **container runtimes**: Docker
    * **orchestration systems**: Kubernetes
    * **logging**: logstash
    * **monitoring**:

## Getting Started

 * [Why Cilium?](http://docs.cilium.io/en/latest/intro/#why-cilium)
 * [Getting Started Guide with Vagrant](http://docs.cilium.io/en/latest/gettingstarted/)
 * [Architecture](http://docs.cilium.io/en/latest/architecture/)
 * [Administrator Guide](http://docs.cilium.io/en/latest/admin/)
 * [Frequently Asked Questions](https://github.com/cilium/cilium/issues?utf8=%E2%9C%93&q=is%3Aissue%20label%3Aquestion%20)
 * [Contributing](http://docs.cilium.io/en/latest/contributing)

## What is eBPF and XDP?

Berkeley Packet Filter (BPF) is a Linux kernel bytecode interpreter originally
introduced to filter network packets, e.g. for tcpdump and socket filters. The
BPF instruction set and surrounding architecture has since been significantly
reworked with additional data structures such as hash tables and arrays for
keeping state as well as additional actions to support packet mangling,
forwarding, encapsulation, etc. Furthermore, a compiler back end for LLVM allows
for programs to be written in C and compiled into BPF instructions. An in-kernel
verifier ensures that BPF programs are safe to run and a JIT compiler converts
the BPF bytecode to CPU architecture specific instructions for native execution
efficiency. BPF programs can be run at various hooking points in the kernel such
as for incoming packets, outgoing packets, system calls, kprobes, uprobes,
tracepoints, etc.

BPF continues to evolve and gain additional capabilities with each new Linux
release. Cilium leverages BPF to perform core data path filtering, mangling,
monitoring and redirection, and requires BPF capabilities that are in any Linux
kernel version 4.8.0 or newer (the latest current stable Linux kernel is
4.10.x).

Many Linux distributions including CoreOS, Debian, Docker's LinuxKit, Fedora,
and Ubuntu already ship kernel versions >= 4.8.x. You can check your Linux
kernel version by running ``uname -a``. If you are not running a recent enough
kernel yet, check the Documentation of your Linux distribution on how to run
Linux kernel 4.9.x or later.

For more detail on kernel versions, see: [Prerequisites](prerequisites)

<p align="center">
   <img src="Documentation/images/bpf-overview.png" width="508" />
</p>

XDP is a further step in evolution and enables to run a specific flavor of BPF
programs from the network driver with direct access to the packet's DMA buffer.
This is, by definition, the earliest possible point in the software stack,
where programs can be attached to in order to allow for a programmable, high
performance packet processor in the Linux kernel networking data path.

## Prerequisites

The easiest way to meet the prerequisites is to use the provided vagrant box
which provides all prerequisites in a sandbox environment. Please see the
[vagrant guide](Documentation/vagrant.rst) for more details.

In order to meet the prerequisites for an installation outside of vagrant,
the following components must be installed in at least the version specified:

 * Linux kernel (http://www.kernel.org/)
    * Minimum: >= 4.8.0
    * Recommended: >= 4.9.17. Use of a 4.9.17 kernel or later will ensure
      compatibility with clang > 3.9.x
 * clang+LLVM >=3.7.1. Please note that in order to use clang 3.9.x, the
   kernel version requirement is >= 4.9.17
 * iproute2 >= 4.8.0: https://www.kernel.org/pub/linux/utils/net/iproute2/

Cilium will make use of later kernel versions if available. It will probe
for the availability of the functionality automatically. It is therefore
perfectly acceptable to use a distribution kernel which has the required
functionality backported.

## Installation

See the [Installation instructions][installation]

## Presentations
{'fraction_non_alphanumeric': 0.10351121154180427, 'fraction_numerical': 0.010429341213280027, 'mean_word_length': 4.756378189094547, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 30, 'https://': 32, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5639025', 'n_tokens_mistral': 3461, 'n_tokens_neox': 3257, 'n_words': 1202}