Beeline moves Layer 7 service mesh policies into eBPF

Service meshes like Istio and Linkerd rely on proxies such as Envoy to enforce both transport-layer (L4) and application-layer (L7) policies, but these proxies introduce significant request latency. While solutions like Cilium and Calico already offload L4 policies into the kernel via eBPF, L7 policies—which make up the majority of real-world configurations—remain stuck in user space because eBPF's verifier struggles with the complex control flow needed to parse protocols like HTTP.

Researchers at ETH Zürich analyzed 4,699 Envoy configurations across 2,417 open-source GitHub projects and found that 89% of deployed L7 policy logic can actually be implemented in eBPF without any kernel changes. Their resulting system, Beeline, synthesizes policy-specific eBPF templates and uses a DFA to extract only the HTTP headers a policy actually needs, avoiding the need for full protocol parsing in the kernel.

By removing the proxy from the critical path for the vast majority of policies, Beeline cuts average request latency by up to 6x and triples throughput on realistic web workloads, all without coordinating with the proxy itself. The project is open source, supports HTTP/1.1 and HTTP/2, and offers engineers a concrete path to eliminating a major source of service mesh overhead.