eBPF allows you to run custom sandboxed code inside the Linux kernel without modifying kernel source code or loading modules.
An operating system is divided into user space for applications and kernel space for core functions, with system calls acting as the interface.
eBPF provides a safer and more dynamic way to run code in the kernel compared to recompiling the kernel or writing unstable kernel modules.
An eBPF program written in C is compiled to bytecode, loaded into the kernel, and executed by a virtual machine when a specific event occurs.
This code walkthrough demonstrates how to write a C program that uses a ring buffer map to capture process ID and name on creation.
Learn how to use the Cilium eBPF library in Go to generate bindings, load the eBPF object, and attach it to a kernel probe (Kprobe).
Understand the role of different hook types like Kprobes and map types like ring buffers for attaching to events and sharing data.
This example shows how to use an XDP hook and an LRU hash map to efficiently count incoming IP packets directly from the network interface.
Discover how open-source projects like Cilium and companies like Edge Delta use eBPF for Kubernetes networking, security, and observability.
ROSEN Technology and Research Center GmbH
Lingen (Ems), Germany
Bitpanda
Vienna, Austria
09:03Ayesha Kaleem
28:20Mohammed Aboullaite
56:19Frank Müller
28:26Igor Todorovski
30:57Önder Ceylan
29:15Onur Gumus
30:51Soroosh Khodami
17:34Dean Oren & Stefan Belsch
Jobs that call for the skills explored in this talk.
Go
Zürich, Switzerland
go-e GmbH
Berlin, Germany
Go
Zürich, Switzerland
