Into the hive of eBPF!

What if you could safely program the Linux kernel without changing its source? Discover how eBPF makes it possible.

#1about 3 minutes

Understanding the origins and naming of eBPF

Learn how eBPF evolved from the classic Berkeley Packet Filter (BPF) and why the names are now used interchangeably in the Linux community.

#2about 4 minutes

Why extending the Linux kernel is traditionally difficult

The Linux kernel manages all system resources, and modifying it historically required either a lengthy core contribution process or maintaining unstable kernel modules.

#3about 4 minutes

Exploring the eBPF architecture and runtime flow

An eBPF program is compiled to bytecode, validated by a verifier for safety, and then JIT-compiled into native code that runs securely inside the kernel.

#4about 3 minutes

A live demo showing eBPF's continuous delivery capability

This simple Python demo illustrates how eBPF programs can be loaded and updated in a running kernel, highlighting benefits like security, efficiency, and continuous delivery.

#5about 5 minutes

Core components of an eBPF program

Discover the essential building blocks of eBPF, including event-driven hooks, key-value maps for state management, and helper functions for interacting with the kernel.

#6about 2 minutes

Practical use cases and libraries for eBPF development

Explore how eBPF is used for network optimization, security, tracing, and profiling, along with popular libraries for Go, Rust, and Python.

#7about 1 minute

Achieving portability with CORE and BTF

The 'Compile Once, Run Everywhere' (CORE) principle, enabled by BPF Type Format (BTF), solves the challenge of running eBPF programs across different kernel versions.

#8about 5 minutes

The eBPF ecosystem, tooling, and future trends

Review popular eBPF-based tools like Cilium and Katran, see how eBPF is changing the sidecar model, and look ahead to its future in hot-fixing and microkernels.