> We replaced the listener with an eBPF program that watches port 8125 at the traffic control layer of every interface, and a JavaScript decoder that turns the lines into Prometheus families.

this is insane! Why on earth would one to replace a short, simple, highly debugable program with this crazy combination. Why would you trade a simple socket(2) call which shows up in ss, netstat, strace etc.. with something that opaque? Especially given the bandwidth is minuscule and the destination is already localhost.

I understand that you can do this, but I'm not sure i understand the rationale. I can't imagine that this is a hot enough path that this makes sense from a performance perspective, so why? What's the benefit?

Naively the thing this is replacing sounds like a much better solution than the replacement is.