Native eBPF overview
One root service, machina-bpfd, provides the datapath, observability and enforcement that used to need Cilium, Tetragon and friends.
Load balancing
Maglev service load balancing, QUIC-LB at XDP, and Fleet Cloud load balancers.
Kubernetes CNI
Opt-in machina-cni replaces flannel, kube-proxy and Cilium; clusters keep their default CNI unless you choose it.
Security enforcement
Policies, DDoS shield, node isolation, VM edge, QEMU sandbox and the VMM guard.
Guest policy
Per-container network and LSM policy inside VMs, enforced by GuestKit and managed from Machina.