A Beginner's Guide to eBPF Programming with Go
summary
Shows practical eBPF workflow: C eBPF programs compiled with clang, user code in Go using libbpfgo, and kernel insertion via the bpf syscall plus perf_event_open and ioctl. Builds a kprobe/raw tracepoint program and a perf event array map to send payloads to user space. Reimplements a bpftrace-style counter of syscalls per command in ~60 Go lines plus a few C lines, requires sudo, verifies in-kernel safety, demos succeed and prints counters on interrupt.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:05What is eBPF?
- 4:34Eyplore bpf syscalls in bpftrace
- 6:43eBPF programs & maps
- 9:56Attach custom code to an event
- 10:35demo
- 11:39How to write eBPF hello world?
- 14:50eBPF hello world
- 24:40eBPF maps
- 25:37demo
- 31:55Recreate bpftrace command
- 32:05demo
- 34:48Outro
