Layer-7 (L7) proxies are critical to modern cloud-native systems, yet their performance is increasingly bottlenecked by copying entire payloads across the kernel-user boundary. Existing approaches reduce this overhead but typically sacrifice compatibility with unmodified POSIX applications, introduce new APIs, or require specialized environments. We show that, under conventional OS abstractions, fully eliminating kernel-user copies while preserving standard socket semantics for unmodified proxies is fundamentally impossible. This leads to a practical insight: in common L7 workloads, proxies inspect only small metadata (e.g., HTTP headers) for routing, while forwarding the bulk payload unchanged. Based on this insight, we present Libra, an OS-level selective-copy framework that copies only metadata to the user space and retains the bulk payload in the kernel for forwarding, reducing data movement without breaking compatibility. Libra uses eBPF to identify protocol-specific metadata boundaries and coordinate selective copy and payload reuse across receive and transmit paths, all without modifying the socket API. Implemented in Linux and evaluated with unmodified Nginx and HAProxy, Libra improves plaintext throughput by up to 4.2x and reduces P99 tail latency by over 90%. With hardware-offloaded kTLS, it boosts encrypted throughput by 2.0x and cuts tail latency by 65%.

翻译：第7层（L7）代理对现代云原生系统至关重要，但其性能日益受限于跨内核-用户边界拷贝完整负载的开销。现有方法虽能减少该开销，却通常以牺牲与未修改POSIX应用的兼容性为代价，或引入新API，或需要专用环境。我们证明，在传统操作系统抽象下，完全消除内核-用户拷贝的同时保持未修改代理的标准套接字语义在根本上不可行。由此得出一项实用洞见：在常见L7工作负载中，代理仅检查用于路由的小型元数据（如HTTP头部），而将大块负载原样转发。基于此洞见，我们提出Libra——一种操作系统级选择性拷贝框架，仅将元数据拷贝至用户空间，将大块负载保留在内核中进行转发，从而在不破坏兼容性的前提下减少数据移动。Libra利用eBPF识别协议特定的元数据边界，并协调接收与发送路径间的选择性拷贝与负载重用，全程无需修改套接字API。在Linux上实现，并以未修改的Nginx和HAProxy评估，Libra将明文吞吐量提升高达4.2倍，P99尾部延迟降低超90%。配合硬件卸载的kTLS，加密吞吐量提升2.0倍，尾部延迟降低65%。