Unlocking eBPF from Go
summary
Shows how to write a small C eBPF program that attaches to the execve kprobe, compiles with clang into main.bpf.o, and loads it from Go using libbpf-go. The Go process starts a ring buffer events reader, decodes little‑endian bytes into a struct and prints pid, ppid and command. The demo compiles, loads, and prints execs on the host on first run. References a larger example project called tracy.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:17A bit about me
- 1:23What is the kernel?
- 2:52When the kernel is working
- 4:28Kernel visibility
- 5:00What is eBPF?
- 6:41You can attach eBPF programs to...
- 9:33What can you do in an eBPF program?
related talks
36mA Beginner's Guide to eBPF Programming with Go
54mTracing Go Programs with eBPF!
39meBPF Superpowers for Go programmers
50mIntroduction to eBPF
23mAn Intro to eBPF with Go : The Foundation of Modern Kubernetes Networking
34mBeyond the Hype: Cloud Native eBPF
29meBPF on the Rise - Getting Started
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security