Service mesh platforms such as Istio and Linkerd have become standard in modern data centre deployments, offering developers a simplified abstraction layer that hides networking complexity. These systems typically rely on sidecar proxies like Envoy to enforce policies—including load balancing and rate limiting—at both the transport layer (Layer 4) and application layer (Layer 7). However, this convenience comes at a performance cost: research has shown that service proxies can add latency of up to 185% to requests.
To mitigate this overhead, advanced service mesh implementations including Cilium and Calico have begun offloading Layer 4 policies to the kernel using extended Berkeley Packet Filter (eBPF). Layer 7 policies, however, continue to be processed in user space. This represents a significant gap, since Alibaba has reported that up to 95% of their customers rely on Layer 7 policies within their service meshes.
The opportunity in Layer 7 optimization
Researchers at ETH Zürich analysed 4,699 distinct Envoy configurations drawn from 2,417 open-source projects on GitHub to understand the complexity of Layer 7 policy enforcement. Their findings revealed that 89% of deployed Layer 7 policies could be implemented in eBPF without requiring kernel modifications. This discovery suggests a practical split-design approach: the majority of Layer 7 policies would run safely in the kernel via eBPF, while the remaining complex policies would transparently fall back to user-space proxies.
The technical challenge lies in eBPF's verification constraints. The kernel performs exhaustive execution path traversal to ensure program safety, a process that becomes impractical for programs with intricate control flows. Layer 7 protocols like HTTP, which employ self-describing structures and require sophisticated parsing and state management, have historically exceeded these limitations.
Beeline: kernel-based Layer 7 policy enforcement
Researchers developed Beeline, an eBPF-based fast path that addresses this constraint. For the 89% of Layer 7 policies found in real deployments, Beeline eliminates the service proxy from the request path entirely. Testing on realistic web applications showed latency reductions of up to six times and throughput increases of three times, all without requiring coordination with the service proxy itself. The system operates transparently and can accelerate any existing service proxy.
Beeline employs two core techniques to work within eBPF's limitations. First, it synthesizes a data plane specifically tailored to each policy, removing unnecessary complexity from a generic implementation. Second, it extracts only the headers required to enforce the policy, avoiding the need for comprehensive parsing logic.
Data plane synthesis
The system generates eBPF-compatible code from a small collection of simple yet expressive templates. Each template contains placeholders that Beeline populates with policy-specific parameters before compilation. Since each template passes eBPF verification independently, the resulting data plane inherits this safety guarantee. For example, a policy redirecting requests to /feed would use a predefined routing template with the target IP address inserted as a parameter.
Protocol parsing
Rather than parsing entire messages, Beeline extracts only the information necessary to enforce each policy. To accomplish this, the system constructs a Deterministic Finite Automaton (DFA) during startup in user space, significantly reducing the complexity of the eBPF program. The kernel-side data plane then uses this DFA to locate relevant data segments in the raw message buffer and perform message delineation.
Current capabilities and future directions
Beeline is available as open-source software and currently supports HTTP/1.1 and HTTP/2. Beyond accelerating service meshes, the underlying approach can extend to other applications. Network operators, for instance, could use Beeline's parser to collect application-layer telemetry directly from the kernel without modifying applications. A packaged version called Beeper provides access to the parsing stage for those interested in experimenting with the technology.