5 Ways eBPF Keeps GitHub Deployments Safe from Circular Dependencies

GitHub hosts its own source code on github.com, creating a unique challenge: if the site goes down, they can't access the code needed to fix it. This classic circular dependency extends to deployment scripts, which might inadvertently call services that depend on GitHub itself. To solve this, GitHub turned to eBPF (extended Berkeley Packet Filter), a Linux kernel technology that allows safe, programmable monitoring and filtering of system calls. Below are five critical insights into how eBPF helps GitHub maintain deployment safety, from identifying dependency types to implementing real-time blocking.

1. The Hidden Danger of Circular Dependencies

Circular dependencies occur when a deployment relies on the very system it's trying to fix. For example, a script that downloads a tool from GitHub during an outage creates a deadlock. GitHub had historically relied on manual reviews to catch these issues, but the process was error-prone. eBPF provides a dynamic, automated solution by monitoring system calls in real time. It can block or log any attempt to access external resources that might create a circular dependency, ensuring deployments remain safe even during incidents. This proactive approach is key to maintaining uptime.

2. Direct Dependencies: The Obvious Trap

Consider a MySQL outage that prevents GitHub from serving release data. A deploy script that tries to fetch the latest version of an open-source tool from GitHub will fail because the site is down. This is a direct circular dependency—the script depends on the very service it's trying to restore. With eBPF, GitHub can write a program that intercepts network-related system calls (like connect or sendto) and examines their arguments. If the call targets github.com or a related IP, eBPF can block it with an error, preventing the script from hanging or crashing. The result: deployments proceed without external dependencies.

3. Hidden Dependencies: When Local Tools Check for Updates

Even if a deployment script uses a tool already on disk, that tool might have a hidden dependency—checking for updates online. If the update check fails because GitHub is down, the tool might hang or return an error, causing the script to fail. These hidden dependencies are hard to detect through manual review. eBPF can monitor all system calls made by child processes, not just the main script. By filtering calls to update servers or package repositories, GitHub ensures that even indirect dependencies don't break deployments. This comprehensive monitoring covers both the script and any tools it invokes.

4. Transient Dependencies: Chained Service Calls

A deployment script might call an internal API, like a migrations service, which in turn tries to fetch a binary from GitHub. This creates a transient dependency—the failure propagates from one service to another. Without eBPF, such chains are hard to trace. GitHub uses eBPF to track system calls across process boundaries, identifying when a child process makes a prohibited call. By setting up eBPF maps to share state between programs, they can propagate filtering rules to all processes spawned by the deployment. This ensures that even deep chains of dependency are caught and blocked.

5. Implementing eBPF: From Monitoring to Blocking

GitHub's eBPF implementation involves attaching programs to specific kernel tracepoints or kprobes. For deployment safety, they focus on syscalls like open, connect, and execve. The eBPF program checks the arguments—for example, the IP address in a connect call. If it matches a blacklist (like GitHub's own servers during maintenance), the program returns an error code, causing the syscall to fail. This is done without modifying the deployment script or the kernel. GitHub also uses eBPF maps to keep counters and logs, giving operators visibility into blocked calls. The result is a lightweight, runtime enforcement layer that adapts to changing conditions.

By leveraging eBPF, GitHub has transformed deployment safety from a manual, error-prone process into an automated, kernel-enforced guard. This approach not only prevents circular dependencies but also provides deep observability into deployment behavior. As eBPF continues to evolve, similar techniques can be applied to other infrastructure safety problems, from container security to network policy enforcement. The key takeaway: with the right kernel tools, even complex circular dependencies can be tamed.