Gentle Introduction to EBPF
summary
eBPF runs sandboxed bytecode inside Linux so you can attach a small program to an event such as execve and print a hello world without changing the kernel; source C compiles via LLVM with BCC or BPFtrace, the BPF verifier rejects unsafe or infinite‑loop code and a JIT turns bytecode into machine instructions. State is shared via BPF maps. Projects like Cilium (which replaces kube‑proxy), Falco and Pixie show real deployments across Google, Netflix, Cloudflare and others.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:00Linux kernel
- 2:40What is EBPF
- 3:40Example
- 5:30Writing EBPF programs
- 6:20BCC
- 6:45BPF Trace
- 9:20EBPF Tools
- 10:25EBPF Runtime
- 10:35EBPF System Call
- 12:30EBPF Maps
- 13:30Helpers
- 14:45Projects
- 16:15Falco
- 17:00Pixie
- 17:50Applications
related talks
29meBPF on the Rise - Getting Started
31meBPF 101
33mThe Future of eBPF in Cloud Native
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
01h 18mTutorial: Getting Started with eBPF
16mWhy Everyone Should Care About eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
39meBPF Superpowers for Go programmers