Introduction to eBPF
summary
Shows how to compile and load eBPF C with libbpf and bpftool, attach tracepoint and cgroup hooks, and communicate via a ring buffer and hash maps (example map sizes: ring buffer 256*1024 bytes, hash max 32 entries). Builds a controller that watches exec names, records monitored PIDs, moves matching processes into a new cgroup and sets a 200 MB memory limit; also attaches cgroup SKB ingress/egress programs to drop or allow packets (works, with occasional packet-hang behavior observed).
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:57What is eBPF
- 8:37Loading eBPF programs
- 12:35Simple eBPF example
- 17:02Inspecting with bpftool
- 20:44Kernel-user space communication
- 22:29eBPF maps and ring buffers
- 28:33Process execution tracking
- 33:55Process exit and cgroups
- 40:25Networking in cgroups
- 47:11Kernel requirements
- 47:53Q&A
related talks
31meBPF 101
16mWhy Everyone Should Care About eBPF
32meBPF: BPF kernel infrastructure
29meBPF on the Rise - Getting Started
38mLinux Kernel Tracing Using eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
53mGetting Started with BPF Security Observability