Show HN: Netfence – Like Envoy for eBPF Filters

To power the firewalling for our agents so that they couldn't contact arbitrary services, I build netfence. It's like Envoy but for eBPF filters. It allows you to define different DNS-based rules that are resolved in a local daemon to IPs, then pushed to the eBPF filter to allow traffic. By doing it this way, we can still allow DNS-defined rules, but prevent contacting random IPs. There's also no network performance penalty, since it's just DNS lookups and eBPF filters referencing memory. It also means you don't have to tamper with the base image, which the agent could potentially manipulate to remove rules (unless you prevent root maybe). It automatically manages the lifecycle of eBPF filters on cgroups and interfaces, so it works well for both containers and micro VMs (like Firecracker). You implement a control plane, just like Envoy xDS, which you can manage t

Kind

startup

Status

Shut down

Inventor

dangoodmanUT

Ended

2026

Source

hackernews