eBPF and TCX bring line-rate network visibility to hostile CI jobs

Blacksmith built a network observability layer for CI jobs that never touches the guest VM, based on the assumption that any workload running arbitrary code must be treated as hostile. Since every CI job runs in its own ephemeral VM whose traffic crosses a single host-side veth pair, the host gets a vantage point the workload can neither see nor evade.

To make raw IP destinations meaningful, a host-side DNS proxy intercepts the guest's port-53 traffic via an iptables DNAT rule and records which domain resolved to which IP on every query. Actual traffic accounting is done by eBPF programs attached to the veth using TCX, the traffic-control hook introduced in Linux 6.6, maintaining per-VM, per-destination byte and packet counters in a hash-of-maps structure with no per-packet event stream.

TCX was chosen over the classic tc/netlink approach because it behaves as a link tied to a file descriptor owned by the agent process, auto-detaching cleanly when the interface disappears and avoiding orphaned tc filters or qdisc conflicts. Because the programs run inline at the tc layer with no extra copy or context switch, overhead stays near zero even at line rate. The result gives engineers a queryable record of exactly what every build talks to, and lays the groundwork for an upcoming egress security policy system.