Fun facts

The first commit was made before eBPF was eBPF

Cilium's git log --reverse shows commit 7fa3c60eb7 titled "Initial commit" dated 2015-12-16. At that point the Linux BPF subsystem was still primarily known as cBPF, the verifier was much stricter, and many of the helpers Cilium relies on today (bpf_redirect_peer, bpf_skb_change_type, bpf_lookup_socket, ...) did not exist yet. A lot of the project's early energy went into shaping the kernel-side primitives Cilium now consumes.

Triple-licensed BPF, single-licensed userspace

The userspace Go code is Apache 2.0. The BPF C code in bpf/ is dual-licensed under the GPL-2.0 and the 2-Clause BSD license — the user can pick either. This dual-license is required because some BPF helpers can only be called from GPL-licensed programs, but Cilium also wants downstream users of the BPF templates to have BSD as an option. Both license texts are in bpf/LICENSE.GPL-2.0 and bpf/LICENSE.BSD-2-Clause.

The agent vendors its dependencies

Cilium commits its full Go vendor tree under vendor/. This makes builds reproducible without requiring access to the module proxy and makes patches to upstream dependencies (when needed) auditable in the same repo.

"Hive" is named after bees

The dependency-injection framework under pkg/hive/ carries the bee metaphor through: cell.Cell, cell.Module, cell.In, cell.Out. Each cell is a small unit of agent functionality; many cells together form the hive. The naming was chosen to be approachable for newcomers used to constructor-injection frameworks in other languages.

Hubble has its own home, but lives here

hubble/, hubble-relay/, and pkg/hubble/ all live in the same monorepo as the agent. The Hubble UI has its own external repo, but the gRPC servers, flow processors, parsers, and Prometheus exporter are part of cilium/cilium so that they can co-evolve with the agent's monitor ring buffer.

The Helm values file is bigger than most apps

Documentation/helm-values.rst is auto-generated from the Helm chart and clocks in at ~213 KB. It is the single largest file under Documentation/. CI enforces that it stays in sync via Documentation/check-helmvalues.sh.

XDP, TC, sockops, and cgroup all in one binary

Cilium loads BPF programs at four different attach points:

• XDP (bpf/bpf_xdp.c) for north-south LB and DDoS defence
• TC (bpf/bpf_lxc.c, bpf/bpf_host.c, bpf/bpf_overlay.c) for the main per-pod and per-host packet path
• cgroup/sockops (bpf/bpf_sock.c) for connect-time service load balancing
• cgroup/sockaddr / sk_msg for socket-level redirection in some accelerated paths

All four are managed by the same loader and orchestrator (pkg/datapath/loader/, pkg/datapath/orchestrator/).

The bugtool predates the rest of the CLI

The bugtool/ binary, used to collect a tarball of agent state for support cases, is one of the older small binaries in the repo. It still works today by execing into running pods and grabbing the contents of every BPF map plus log files plus the agent's REST API state.

cilium-cli lived in a separate repo for years

The user-facing cilium CLI was originally in cilium/cilium-cli. It was merged into this monorepo, and you can still see the seams: cilium-cli/ has its own go.mod-style structure layered on top of the parent module, its own Makefile, and its own Dockerfile.