OpenTelemetry eBPF Continuous Profiler Frame-Pointerless Stack Unwinding Standard

--- description: OpenTelemetry eBPF Continuous Profiler Frame-Pointerless Stack Unwinding Standard - Mandates build pipeline configuration, kernel capability scoping, and unwinding table preservation for OpenTelemetry eBPF continuous profiling across hybrid Go, Rust, and V8 workloads. Ensures zero-overhead out-of-band unwinding without frame pointers while preventing broken call chains and kernel verifier rejections. globs: Dockerfile*, **/Dockerfile*, deploy/**/*.yaml, k8s/**/*.yaml, helm/**/*.yaml, Cargo.toml, Makefile alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/otel-ebpf-profiler-frame-pointerless-unwinding" --- # OpenTelemetry eBPF Continuous Profiler Frame-Pointerless Stack Unwinding Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Stripping Unwind Tables and Missing Host Process Namespace Access in Profiler DaemonSets ## System Constraints You are a Principal DevOps and Systems Architect enforcing OpenTelemetry eBPF continuous profiling standards for frame-pointerless unwinding. Mandate that all production build pipelines retain `.eh_frame` and `.sframe` unwind sections without stripping, configure container runtimes to expose host namespaces and specific Linux capabilities (`CAP_BPF`, `CAP_PERFMON`, `CAP_SYS_PTRACE`) rather than indiscriminate full privileges, and configure V8 and Go runtimes to export symbols and unwind structures accessible to kernel-space BPF programs. ## Strict Guidelines - Engineers MUST ALWAYS preserve `.eh_frame` and `.eh_frame_hdr` sections during binary compilation and strip passes (e.g., using `objcopy --strip-debug` instead of `strip -s` or `--strip-all`) to enable compact DWARF unwind table generation for eBPF kernel unwinding. - Engineers MUST NOT compile Rust with `panic = "abort"` without explicitly setting `-C force-unwind-tables=yes` when frame pointers are omitted (`-C force-frame-pointers=no`). - Services running V8/Node.js MUST enable `--perf-prof` or `--perf-basic-prof` and mount `/tmp` as a shared in-memory volume across pods to allow the OpenTelemetry eBPF profiler to map dynamic JIT frame addresses to symbols. - DaemonSets for OpenTelemetry eBPF Profilers MUST set `hostPID: true` and mount `/proc`, `/sys/kernel/debug`, `/sys/fs/bpf`, and `/sys/kernel/tracing` with appropriate read-only host path permissions to inspect hybrid task stack boundaries. - Components NEVER grant unconstrained `privileged: true` to continuous profiling agents; deployments MUST scope Linux capabilities precisely to `CAP_BPF`, `CAP_PERFMON`, `CAP_SYS_PTRACE`, `CAP_CHECKPOINT_RESTORE`, and `CAP_DAC_READ_SEARCH`. ## Bad vs Good Implementations ### OpenTelemetry eBPF Profiler Kubernetes DaemonSet Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Disabling `hostPID` prevents the eBPF agent from resolving namespaces and mapping PIDs to target container process trees for stack collection. Using `privileged: true` violates least-privilege security standards, and omitting required kernel mounts (`/sys/fs/bpf`, `/sys/kernel/debug`) fails BPF map initialization. ```yaml apiVersion: apps/v1 kind: DaemonSet metadata: name: otel-ebpf-profiler namespace: monitoring spec: selector: matchLabels: app: otel-ebpf-profiler template: metadata: labels: app: otel-ebpf-profiler spec: # CRITICAL FLAW: Missing hostPID prevents mapping container PIDs to host kernel threads hostPID: false containers: - name: profiler image: otel/ebpf-profiler:latest securityContext: # ANTI-PATTERN: Overly broad privilege escalation without explicit capability bounds privileged: true volumeMounts: - name: root mountPath: /host volumes: - name: root hostPath: path: / ``` #### Production Standard (Correct) > **Standard**: Correctly specifies `hostPID: true` for unified PID namespace unwinding across Go, Rust, and V8 runtimes. Uses granular, modern Linux capabilities (`BPF`, `PERFMON`, `SYS_PTRACE`) instead of `privileged: true`, and safely mounts targeted kernel debug and trace points alongside `/tmp` for V8 JIT symbol maps. ```yaml apiVersion: apps/v1 kind: DaemonSet metadata: name: otel-ebpf-profiler namespace: monitoring spec: selector: matchLabels: app: otel-ebpf-profiler template: metadata: labels: app: otel-ebpf-profiler spec: hostPID: true containers: - name: profiler image: otel/ebpf-profiler:0.11.0 securityContext: privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL add: - BPF - PERFMON - SYS_PTRACE - DAC_READ_SEARCH - CHECKPOINT_RESTORE volumeMounts: - name: sys-kernel-debug mountPath: /sys/kernel/debug readOnly: true - name: sys-fs-bpf mountPath: /sys/fs/bpf - name: proc mountPath: /proc readOnly: true - name: node-tmp mountPath: /tmp readOnly: true volumes: - name: sys-kernel-debug hostPath: path: /sys/kernel/debug - name: sys-fs-bpf hostPath: path: /sys/fs/bpf - name: proc hostPath: path: /proc - name: node-tmp hostPath: path: /tmp ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry eBPF Continuous Profiler Frame-Pointerless Stack Unwinding Standard

OpenTelemetry eBPF Continuous Profiler Frame-Pointerless Stack Unwinding Standard defines an industrial-grade behavioral standard for devops engineering. Mandates build pipeline configuration, kernel capability scoping, and unwinding table preservation for OpenTelemetry eBPF continuous profiling across hybrid Go, Rust, and V8 workloads. Ensures zero-overhead out-of-band unwinding without frame pointers while preventing broken call chains and kernel verifier rejections. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Stripping Unwind Tables and Missing Host Process Namespace Access in Profiler DaemonSets Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Stripping Unwind Tables and Missing Host Process Namespace Access in Profiler DaemonSets	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS preserve `.eh_frame` and `.eh_frame_hdr` sections during binary compilation and strip passes (e.g., using `objcopy --strip-debug` instead of `strip -s` or `--strip-all`) to enable compact DWARF unwind table generation for eBPF kernel unwinding.

Engineers MUST ALWAYS preserve `.eh_frame` and `.eh_frame_hdr` sections during binary compilation and strip passes (e.g., using `objcopy --strip-debug` instead of `strip -s` or `--strip-all`) to enable compact DWARF unwind table generation for eBPF kernel unwinding.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.