Rust in the Kernel (via eBPF)
summary
A Rust eBPF toolchain is already usable: Aya plus a custom BPF Linker compiles Rust crates to a single eBPF object, shares a common crate between userland and kernel programs, and pushes logs to userspace via ring buffers; projects at Deepfence, Parca and Red Hat use it in production. It requires Rust nightly for the bpf target, lacks BTF/atomics/spinlock support so some APIs remain unsafe, and developers report successful builds but ongoing BTF issues and verifier edge cases.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:32How eBPF is eating the kernel
- 3:12How eBPF is compiled
- 4:56Rust compilation
- 5:46eBPF Linker
- 7:33eBPF Input
- 8:26eBPF Ecosystem
- 12:30eBPF in Rust
- 13:55Error handling
- 14:55Common crate
- 16:39Build dependencies
- 17:49eBPF templates
- 18:59Kernel space
- 20:29BTF
- 23:51Kernel types
- 24:53Question time
- 25:56Example code
- 29:51Safety documentation
related talks
46mTracing the Linux kernel with eBPF and Rust
30mRun Fast! Catch Performance Regressions in eBPF with Rust
35mEbpf with Rust: The Journey of a Package
40m"Auto-Instrumenting Rust Applications Using eBPF and OpenTelemetry"
30mRex and its integration with Rust-for-Linux
51mRust in the Linux kernel
46mRust for Linux
26mIntroducing Rust into a Legacy Embedded System