seccomp: Lazily construct precompiled seccomp programs - #14795
Merged
Merged
Conversation
GetPrecompiled() eagerly built a map of every precompiled seccomp program via registerPrograms(), materializing the bytecode of all programs at sandbox startup. With 432 programs totaling ~3.4MB of BPF bytecode, this cost ~8ms per sandbox even though each sandbox only looks up a single program. Change the code generator to emit a switch statement instead, so that only the bytecode of the requested program is constructed. This drops GetPrecompiled() from ~8ms to ~40us, and the "precompiled seccomp program rendered" startup phase from ~10.5ms to ~0.26ms. Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
copybara-service
Bot
requested review from
EtiennePerot and
fvoznika
as code owners
September 16, 2026 23:53
copybara-service
Bot
force-pushed
the
test/cl982799777
branch
3 times, most recently
from
September 17, 2026 05:12
030df60 to
450a774
Compare
…omp_progs PiperOrigin-RevId: 982947002
copybara-service
Bot
force-pushed
the
test/cl982799777
branch
from
September 17, 2026 05:39
450a774 to
51a455c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
seccomp: Lazily construct precompiled seccomp programsGetPrecompiled() eagerly built a map of every precompiled seccomp program via registerPrograms(), materializing the bytecode of all programs at sandbox startup. With 432 programs totaling ~3.4MB of BPF bytecode, this cost ~8ms per sandbox even though each sandbox only looks up a single program.
Change the code generator to emit a switch statement instead, so that only the bytecode of the requested program is constructed. This drops GetPrecompiled() from ~8ms to ~40us, and the "precompiled seccomp program rendered" startup phase from ~10.5ms to ~0.26ms.
Assisted-by: DeepSeek:DeepSeek-V3
FUTURE_COPYBARA_INTEGRATE_REVIEW=#14674 from ruanjinjie-eng:Lazily_precompiled_seccomp_progs 581a20c