Forwarding packets at scale - Building a Cloud Data Plane using eBPF/XDP#

Maximilian Wilhelm, Marcus Wichelmann (Hetzner)

• Why: Hetzner replaced an Open vSwitch-based cloud dataplane with a custom eBPF/XDP stack serving hundreds of thousands of cloud servers — a production deployment of eBPF as a cloud data plane at real scale. Directly relevant to the PM's eBPF/datapath interests.
• What: The hcnet XDP-based network stack handles public and private cloud networking (VXLAN encapsulation), stateful firewalls, DHCP, traffic capture — all in XDP with a Go control plane. Running in Hetzner's internal cloud for two years, approaching public beta. Covers architecture, challenges, and current XDP limitations (offloading, driver maturity).
• How: eBPF programs at the XDP hook handle ARP/NDP/ICMP responding, port security, stateful firewall (compiled from a ruleset definition into eBPF instructions via graph optimization), VXLAN VTEP, and DHCP/metadata server. Diagnostic tooling (hcnet capture, conntrack map inspection) provides per-interface stats and pcap capture from XDP. Self-healing design with meaningful metrics. Kernel patches submitted for tun XDP metadata support; active upstream driver bug engagement (e.g., ixgbe bonding).
• Where applicable: Cloud/hosting providers, large-scale Linux-based fabrics. The approach requires deep in-house eBPF expertise and willingness to maintain kernel patches. Hetzner-specific scale (hundreds of thousands of servers) but the architecture patterns (XDP gateway per node, stateful firewall in BPF, Go control plane) are broadly adoptable.