Linux io_uring — Async I/O Rings, liburing, Registered Resources & Security-Disable Saga
Parent: DevOps, Infrastructure & Observability · researched 2026-06-01T04:32:48.189Z· 11 sources · 13 concepts · skill devops-infra
DevOps / infrastructure / observability family ROUTER. Split into focused sub-hubs — route to: devops-linux-internals (kernel, boot, memory/NUMA, storage/filesystems, virtualization, io_uring, cgroups
devops-infra
- DevOps / infrastructure / observability family ROUTER. Split into focused sub-hubs - route to: devops-linux-internals (kernel, boot, memory/NUMA, storage/filesystems, virtualization, io_uring, cgroups/namespaces, sandboxing, immutable Linux, privilege); devops-linux-admin (sysadmin, systemd, package management, shell scripting, host networking diagnostics); devops-containers-cicd (Docker, Kubernetes, CI/CD pipelines, Terraform/Kafka IaC, git workflows, library packaging); devops-observability (Node/OTel observability, Pino logging, Sentry, eBPF, Linux perf tracing). Pick the sub-hub matching the task. [source]
- This hub routes to on-demand reference files under references/. See each spoke for depth. [source]
Children
- The two-ring shared-memory model (SQ + CQ, SQE/CQE structs, head/tail, indirection array) (frontier)
- The three syscalls (io_uring_setup / io_uring_enter / io_uring_register) (frontier)
- liburing userspace library (queue_init, get_sqe, prep_*, submit, wait_cqe, cqe_seen, for_each_cqe) (frontier)
- Submission/completion modes (default interrupt-driven, IORING_SETUP_SQPOLL kernel poller, IORING_SETUP_IOPOLL busy-poll, COOP/DEFER_TASKRUN/SINGLE_ISSUER) (frontier)
- Registered/fixed buffers + READ_FIXED/WRITE_FIXED and O_DIRECT win (frontier)
- Registered/fixed files + IOSQE_FIXED_FILE and direct descriptors (frontier)
- Provided buffer rings (IORING_REGISTER_PBUF_RING, kernel-picked buffer IDs) (frontier)
- SQE ordering and chaining (IOSQE_IO_LINK/HARDLINK/IO_DRAIN/ASYNC/CQE_SKIP_SUCCESS) (frontier)
- Multishot operations (multishot accept/recv/poll, IORING_CQE_F_MORE, re-arming) (frontier)
- Zero-copy networking (IORING_OP_SEND_ZC two-CQE F_MORE/F_NOTIF 6.0, zero-copy receive 6.15, NAPI busy-poll) (frontier)
- Kernel-version feature timeline (5.1 introduction -> 6.x maturation) (frontier)
- The 2023-2025 security-disable saga (Google 60%-of-exploits, ChromeOS/Android disable, Docker/containerd seccomp default, why seccomp does not filter ops in the ring) (frontier)
- Kernel-side controls (io_uring_disabled sysctl, IORING_SETUP_R_DISABLED + IORING_REGISTER_RESTRICTIONS allowlist, task-level restrictions, Curing rootkit) (frontier)
Frontier under this node: Kernel-side controls (io_uring_disabled sysctl, IORING_SETUP_R_DISABLED + IORING_REGISTER_RESTRICTIONS allowlist, task-level restrictions, Curing rootkit), Kernel-version feature timeline (5.1 introduction -> 6.x maturation), Multishot operations (multishot accept/recv/poll, IORING_CQE_F_MORE, re-arming), Provided buffer rings (IORING_REGISTER_PBUF_RING, kernel-picked buffer IDs), Registered/fixed buffers + READ_FIXED/WRITE_FIXED and O_DIRECT win, Registered/fixed files + IOSQE_FIXED_FILE and direct descriptors, SQE ordering and chaining (IOSQE_IO_LINK/HARDLINK/IO_DRAIN/ASYNC/CQE_SKIP_SUCCESS), Submission/completion modes (default interrupt-driven, IORING_SETUP_SQPOLL kernel poller, IORING_SETUP_IOPOLL busy-poll, COOP/DEFER_TASKRUN/SINGLE_ISSUER), The 2023-2025 security-disable saga (Google 60%-of-exploits, ChromeOS/Android disable, Docker/containerd seccomp default, why seccomp does not filter ops in the ring), The three syscalls (io_uring_setup / io_uring_enter / io_uring_register), The two-ring shared-memory model (SQ + CQ, SQE/CQE structs, head/tail, indirection array), Zero-copy networking (IORING_OP_SEND_ZC two-CQE F_MORE/F_NOTIF 6.0, zero-copy receive 6.15, NAPI busy-poll), liburing userspace library (queue_init, get_sqe, prep_*, submit, wait_cqe, cqe_seen, for_each_cqe)