A question I had: is it really worth 2k of complicated kernel code to
*maybe sometimes* save <10Mb of memory?
There are many reasons this is worth it. The main ones:
1. This did not start from a number we picked, but from a real use
case: users who run large fleets of small instances, 1 GiB of
memory or less, with their workloads sized to fit. We are not able
to disclose more detail, but for them 5.4 MB on every instance is
real money, and it can be exactly what pushes a workload over its
memory budget and onto the next instance size. That is why we took
this on, even though we knew it would not be a small change.
2. Loading code and data only when a system needs them is what kernel
modules exist for. And most of them take well under ~1 MB once
loaded (nf_conntrack, overlay, vfat); even big ones like ext4, kvm
and btrfs stay around 1-2.5 MB. The vmlinux BTF is 5.4 MB.
3. We are not alone in trying to keep BTF out of memory until it is
needed. The inline BTF work [1] plans to deliver its data, which
is even larger, through a module too. The .BTF.link record and the
resolve_btfids option that serve both are already part of this
series (patch 10), so this is not machinery for the vmlinux BTF
alone.
Do those tiny VMs that you target run systemd with BPF LSM?
Not necessarily, and that is the image's choice. Even with BPF LSM
built in and bpf in CONFIG_LSM, memory-conscious users can turn it off
at boot with an lsm= list that leaves it out, and then systemd does not
load restrict_fs at all.
And even where user space is in the way, which as above it does not
have to be, the answer is to fix user space so it gets this win too,
not to give up on it.
If the answer is "yes" for the majority of them,
"The majority" is also hard to pin down here: what runs at boot
depends on the user space packages built into each image, and on the
workload.
So the question should be what it takes to make this work, not whether
to drop it because it is complicated. If there are ways to cut it
down, or issues found in the implementation, we would be happy to take
them and go through every one.
[1] https://lore.kernel.org/bpf/20260916074118.1007116-1-alan.maguire@oracle.com/ (local)