Release the shared kernel BTF cache after Start()

[mbertrone]

What

Manager.Start() already releases VerifierOptions.Programs.KernelTypes once program loading is done (unless KeepKernelBTF is set), but it never released VerifierOptions.Cache — the shared *btf.Cache introduced with the cilium/ebpf v0.22.0 upgrade. A long-lived manager therefore keeps that cache, and the parsed kernel vmlinux BTF it holds, pinned for the entire process lifetime, regressing idle memory for downstream consumers.

This clears VerifierOptions.Cache symmetrically with KernelTypes, via a small releaseKernelBTF() helper.

Why it's safe

• VerifierOptions.Cache is only consumed while loading the collection (loadCollection → ebpf.NewCollectionWithOptions), which runs during InitWithOptions/postInit, strictly before Start().
• Nothing reads .Cache after Start(). The only post-Start program load, CloneProgram, goes through the exported ebpf.NewProgramWithOptions, which allocates its own fresh btf.NewCache() and relies on KernelTypes (not .Cache) for CO-RE relocations — which is why the clear stays gated on !KeepKernelBTF.

Why it's sufficient

The loaded ebpf.Collection/ebpf.Program don't retain the cache (a Program keeps only its own btf.Handle); the *btf.Cache otherwise lives only in the transient collection loader. So the manager's VerifierOptions.Cache field is the only long-lived reference — clearing it lets the parsed kernel BTF become GC-eligible.

Test

TestReleaseKernelBTF (table-driven, no kernel/root needed) covers both paths: released when !KeepKernelBTF, retained when set. gofmt and go vet clean.

🤖 Generated with Claude Code