Tutorial: Getting Started with eBPF
summary
Hands-on labs teach eBPF fundamentals by compiling C to eBPF bytecode (using BCC and clang), loading programs and inspecting them with bpftool, and exchanging data via maps and verifier checks. Examples include a working hello world attached to execve, an XDP program that drops ping packets to mitigate a kernel packet-of-death vulnerability, and demonstrations of verifier failures and bytecode inspection. Labs run in transient sandboxes (instruct) and link to a longer “compile once run everywhere” workflow and book.
AI-written summary · about
chapters (9)
- 0:00eBPF introduction
- 3:18What is eBPF
- 10:43Hello World eBPF lab
- 16:28eBPF maps and data
- 23:24Compiling eBPF programs
- 31:36BPF tool exploration
- 40:06eBPF networking security
- 57:09eBPF verifier safety
- 1:01:37Use cases Q&A
related talks
29meBPF on the Rise - Getting Started
14mWriting Custom eBPF Programs for O11y: What You Need to Know
31meBPF 101
20mGentle Introduction to EBPF
28mDeveloping Modern eBPF Applications
39meBPF Superpowers for Go programmers
32meBPF: The Next Power Tool of SREs
53mGetting Started with BPF Security Observability