8 Crucial Ways GitHub Uses eBPF to Break Deployment Circular Dependencies

GitHub runs on itself. While that sounds like a testament to dogfooding, it creates a dangerous circular dependency: if github.com goes down, engineers can't access the very code needed to fix it. This problem magnifies during deployments. In this article, we explore eight key insights from GitHub's use of eBPF (extended Berkeley Packet Filter) to detect and block circular dependencies in deployment scripts. You'll learn the types of dependency traps, why traditional safeguards fall short, and how eBPF provides a lightweight, runtime layer of protection.

1. The Self-Hosting Circular Dependency

GitHub hosts all its source code on its own platform. This means any outage of github.com immediately prevents engineers from pulling the latest code, creating a deadlock: you need GitHub to fix GitHub. To break this loop, GitHub maintains a separate mirror of critical repositories and pre-built rollback assets. However, this only solves the most obvious problem. Deploy scripts themselves can introduce new circular dependencies that aren't covered by the mirror strategy.

2. Direct Dependency Pitfalls

Consider a MySQL outage. An engineer runs a deploy script that needs to download an open-source binary from GitHub. Because GitHub is down, the script fails — a classic direct dependency. Even though the binary is stable and unrelated to the outage, the script's reliance on a GitHub endpoint creates a hard block. eBPF can intercept these outbound calls and either redirect them to a local cache or block them outright based on policy.

3. Hidden Dependencies: Silent Failures

Sometimes a script doesn't explicitly call GitHub, but a tool it invokes checks for updates. This hidden dependency may cause the script to hang or fail when the update check times out. The engineer may not even know the tool had this behavior. eBPF can monitor all network calls made by the deployment process and its children, flagging any connection to domains or IPs that are considered 'dangerous' during an incident.

4. Transient Dependencies via Internal Services

A deploy script might call an internal migrations service via API. That service, in turn, tries to download a binary from GitHub. The failure propagates backward, causing the deploy script to fail even though it never directly talked to GitHub. These transient dependencies are hard to trace manually. eBPF's kernel-level visibility lets you define rules that cover an entire call chain, not just the top-level process.

5. Traditional Mitigations Are Brittle

Before eBPF, GitHub relied on manual code reviews and documentation to prevent circular dependencies. Teams owning stateful hosts had to audit their scripts constantly. This approach proved error-prone and didn't scale. Hidden and transient dependencies often slipped through. Additionally, a well-meaning script that worked yesterday could break today if a library introduced a new update check. Static checks alone cannot keep up.

6. Why eBPF Is a Game Changer

eBPF allows you to run sandboxed programs in the Linux kernel without modifying kernel source code or loading modules. For deployment safety, GitHub attaches eBPF programs to system calls like connect() and open(). These programs can inspect the destination address, port, or file path and decide to allow, deny, or log the operation — all with near-zero overhead. This provides a dynamic, policy-driven safety net that runs with every deploy.

7. Writing a Simple eBPF Blocker

GitHub's solution uses eBPF to monitor network connections made by the deploy script's process tree. A sample program might load a map of banned IP ranges (like GitHub's own public IPs) and refuse any outbound connection to them. On match, the program returns -EPERM, causing the socket call to fail. The deployment infrastructure catches this error and either retries with a local mirror or aborts with a clear message. Back to top

8. Real‑World Impact and Future Plans

GitHub's eBPF-based system has already caught several circular dependencies that escaped manual reviews. The runtime check runs seamlessly during every deployment to stateful nodes. Going forward, GitHub plans to extend eBPF policies to cover filesystem reads and writes, preventing scripts from downloading binaries to disk as well. This approach not only improves deployment safety but also serves as a blueprint for any organization with self-hosted infrastructure.

eBPF gives you surgical control over what your deployment scripts can and cannot do. By shifting from static reviews to kernel‑enforced policies, GitHub has made its deployments more resilient against the very circular dependencies that once threatened to take down the platform. Whether you run a small cluster or a massive fleet, the lessons from GitHub's experience are worth adopting.