Bomfather open-sources inode-based caching technique that cuts eBPF security agent's kernel CPU cost by ~90%

The team behind Bomfather, an open-source eBPF security agent, added a memoization cache keyed on mount namespace ID, mount ID and inode number, so the kernel stops re-walking the filesystem path every time a policy check runs against a file it has already resolved. In their own benchmark (opening the same file 200,000 times), kernel cycles fell from 28 billion to 3.03 billion, roughly a 90% cut in kernel CPU cost. The code and the underlying method are published in Bomfather's GitHub repo and an accompanying engineering blog post, so the claim is directly inspectable.

This only matters to teams already running or evaluating Bomfather, or engineers building similar eBPF/LSM-based security or observability agents who repeatedly resolve the same file paths (the post calls out database workloads as a good fit). It is a legitimate, well-documented engineering optimisation, not a new capability or market shift: no policies change, no new product exists, and nothing changes for anyone outside this fairly narrow eBPF tooling niche.

The "~90%" figure comes from one synthetic benchmark (opening one file 200,000 times in a loop), not a production workload, so real-world gains will vary and are likely smaller for mixed file-access patterns. This is also only loosely an "AI" story, it surfaced via a Hacker News AI feed despite the article's own title flagging it as not AI-generated content, and the underlying technique (dentry path-walk memoization) is a standard, well-known optimisation rather than a novel breakthrough.

1. 01Independent benchmarks from third parties running Bomfather against realistic, non-synthetic (mixed-file) workloads, not just the vendor's repeated-open test
2. 02Adoption signals: GitHub stars/forks, downstream projects citing or forking the memoization approach, or other eBPF security tools (e.g. Falco, Tetragon) adopting similar caching
3. 03Whether Bomfather or its backers announce any commercial traction, funding, or enterprise customers tying this performance work to real deployment decisions