Skip to main content

IO Visor

Inference Orchestrator (IO) Visor is an open source project under The Linux Foundation that provides an extensible, programmable data plane framework based on eBPF for networking, security, tracing, and monitoring use cases in modern infrastructures.

  • Extensible data plane built on extended Berkeley Packet Filter (eBPF) (networking / observability / security).
  • Runtime infrastructure for dynamically loading, running, and updating packet and system processing programs in the kernel (infrastructure / systems runtime).
  • Tooling and libraries for building user space and kernel space IO modules that can be composed and reused (developer framework).
  • Support for use cases such as traffic control, firewalls, load balancing, tracing, and telemetry collection (networking / security / observability).
  • Hosted as a community-driven project under The Linux Foundation with a focus on pluggable IO and policy control across software-defined infrastructures (open-source foundation project).

More About IO Visor

IO Visor is a collaborative open source project hosted by The Linux Foundation that focuses on creating a programmable IO and data plane layer using extended Berkeley Packet Filter (eBPF) technology (networking / observability / security). The project targets environments where operators need to insert custom logic into the Operating System (OS)’s packet and event processing paths without modifying kernel code or rebooting systems. This applies to software-defined infrastructure, cloud platforms, and container-based deployments that require policy enforcement, traffic steering, and observability at the kernel level.

The core concept of IO Visor is a virtualized IO layer that allows developers and operators to load eBPF-based programs into the kernel to process packets, system calls, or other events (infrastructure runtime). These eBPF programs can implement functions such as traffic filtering, classification, metering, or telemetry generation. IO Visor provides runtime components and APIs to manage the lifecycle of these programs, including loading, attaching to kernel hooks, updating, and unloading them at runtime. This approach enables dynamic behavior changes in networking and security policies without kernel recompilation.

From a capabilities perspective, IO Visor is positioned across several enterprise IT categories. It supports network packet processing and Traffic Engineering (TE) (networking), in-kernel firewalls and access controls (security), and low-overhead tracing and metrics collection (observability). By relying on eBPF, IO Visor allows these functions to run in kernel context while being developed and maintained in a user space toolchain, which can streamline operations for platform and Site Reliability Engineering (SRE) teams. The project’s focus on modular IO programs supports reuse and composition across different data paths and deployments.

In enterprise and institutional environments, IO Visor is relevant wherever Linux-based systems underpin virtualized networks, container orchestration platforms, or multi-tenant environments (cloud infrastructure). Operators can use IO Visor’s eBPF-based approach to implement per-tenant policies, detailed flow monitoring, or custom telemetry pipelines. The ability to deploy and update IO logic at runtime aligns with Continuous Deployment (CD) workflows and automated infrastructure management, enabling configuration-driven changes to packet and event handling rules.

IO Visor also fits into a broader ecosystem around eBPF (systems instrumentation), interacting conceptually with tools that compile and manage eBPF programs while remaining focused on the data plane layer and its runtime handling. As a project under The Linux Foundation, it follows an open governance and community development model. For directory and taxonomy purposes, IO Visor can be categorized under “eBPF-based data plane framework,” with cross-listings in networking (software-defined networking and traffic control), security (in-kernel policy enforcement), and observability (eBPF-based tracing and metrics).