At ASG2018 hack we discussed a path to allow users to ask Systemd to install BPF programs into cgroups. This issue is to document that design as an RFE.

The motivation is to allow users to associate a BPF program with a unit file so that systemd can install them after the cgroup is setup.

The design we came up with was:

The user would be responsible for creating any maps, loading the program and associating any maps with the program. At this point the user simply needs to pass the FD for the BPF program to systemd. The suggested name for this was BPFProgramPath. In this case, the suggested way of doing this was via /proc/$PID/fds/<appropriate FD>.

An option to systemd-nspawn could then be made to expose this as well.