Python-BPF: Writing eBPF programs in pure Python
summary
Python-BPF lets developers write eBPF logic and userspace in one reduced Python grammar file, compiles by generating kernel structs from vm_linux.py, emits LLVM IR in two passes, runs llc to produce an object, and loads with pybpf. Current support includes hash, per-cpu, array, perf event array and ring buffer maps. Demos work: a container monitor (syscalls, net, IO TUI), a notebook neural-net anomaly detector (116 events, 1 anomaly), Blazem symbolization via Rust, and a 5,000-sample VFS latency live dashboard. It adds auto null and bounds checks but still sees verifier failures during new experiments.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:35Problem statement
- 2:23Python-BPF overview
- 3:41Internal mechanics
- 5:36Container monitor demo
- 7:36Neural net anomaly detection
- 11:20Rust integration demo
- 13:14VFS read latency demo
- 16:42Benefits and challenges
- 18:18Future goals and roadmap
- 21:58Q&A session
related talks
20mSecimport: Tailor-Made eBPF Sandbox for Python Applications
26mEnabling Cyber Physical systems using Beaglebone Black and Python
24mMaking Games With PPB
37mExtending the Python Ecosystem to Xilinx
49mYou Used Python for What?!
21mFrom PyPerf to py-spy - Everything You Need to Know About Python Profilers
40mBuild Wireless Products Faster with Zephyr and MicroPython
09mPython and Bazel: Aspect’s rules_py