> Markdown version of [/videos/789-gentle-introduction-to-ebpf?t=136](https://www.wearedevelopers.com/videos/789-gentle-introduction-to-ebpf?t=136). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Gentle Introduction to eBPF Want to modify kernel behavior without altering source code? Discover how eBPF lets developers safely run custom bytecode for advanced observability, networking, and security. - **Speakers:** Ayesha Kaleem - **Event:** World Congress 2023 - **Published:** October 23, 2023 - **Duration:** 9:03 - **URL:** https://www.wearedevelopers.com/videos/789-gentle-introduction-to-ebpf ## Summary Modifying the Linux kernel for advanced observability, networking, or security features has historically been fraught with slow community consensus cycles and lengthy distribution updates. eBPF (Extended Berkeley Packet Filter) solves this rigid structure by acting as a secure virtual machine within the Linux kernel. It allows infrastructure developers to safely run custom bytecode in response to kernel-level events—such as network packets or function calls—without the need to alter kernel source code or load potentially dangerous kernel modules. The power of eBPF lies in its meticulous safety constraints and high performance. When an eBPF program is compiled into bytecode and loaded, an eBPF verifier strictly checks for infinite loops and invalid conditions before passing the program to a Just-In-Time (JIT) compiler, which optimizes execution speed at the machine level. To maintain seamless communication between the kernel and user-space applications, eBPF Maps utilize versatile data structures, such as hash maps and arrays, to bridge system states in real time. By leveraging event-driven system call hooks alongside toolchains like BCC and bpftrace, developers can build powerful monitoring agents without deep kernel programming expertise. This powerful abstraction has spawned a massive ecosystem of enterprise-grade, cloud-native tools. Prominent solutions include Cilium for robust Kubernetes networking and kube-proxy replacement, Falco for detecting malicious container activity, and Pixie for deep cluster observability. Adopted natively by tech giants like Google, Meta, and Netflix, eBPF fundamentally shifts how developers achieve kernel-level visibility without sacrificing stability. **Keywords:** linux kernel observability, ebpf virtualization, kernel system call hooking, bcc library toolchain, bpftrace scripting, llvm clang compilation, ebpf verifier safety, jit compiled bytecode, ebpf memory maps, cilium kubernetes networking, kube-proxy replacement, falco container security, pixie cluster observability, katran layer 4 load balancer, user-space process monitoring ## Chapters 1. **Overcoming the challenges of modifying Linux kernel code** (00:09) — Upstreaming observability features into the Linux kernel is traditionally slow and complex. 1. **Introduction to eBPF as a secure virtual machine** (01:24) — How eBPF runs custom bytecode dynamically without altering kernel source code. 1. **Attaching eBPF programs to event-driven kernel hooks** (02:16) — Triggering observability and networking logic automatically on system calls and network events. 1. **Writing eBPF programs using BCC and bpftrace libraries** (02:56) — Utilizing high-level languages and LLVM compilers to build and load a custom trace. 1. **Ensuring kernel safety with the eBPF verifier** (05:01) — How the verifier and JIT compiler guarantee program safety and execution speed before attachment. 1. **Synchronizing state between kernel and user space** (06:19) — Using eBPF maps to pass and store execution data structures safely. 1. **Leveraging existing eBPF tools and enterprise projects** (06:54) — Adopting pre-built solutions like Cilium, Falco, and Pixie without writing custom lower-level code. ## Related Moments - [Introduction to the growing popularity of eBPF](https://www.wearedevelopers.com/videos/1199-into-the-hive-of-ebpf) (from "Into the hive of eBPF!") - [Making the Linux kernel programmable with sandboxed execution](https://www.wearedevelopers.com/videos/1199-into-the-hive-of-ebpf) (from "Into the hive of eBPF!") - [Overview of eBPF and Edge Delta observability pipelines](https://www.wearedevelopers.com/videos/1075-an-applied-introduction-to-ebpf-with-go) (from "An Applied Introduction to eBPF with Go") - [Protecting hardware access controls using eBPF security hooks](https://www.wearedevelopers.com/videos/1119-a-hitchhikers-guide-to-container-security-automotive-edition-2024) (from "A Hitchhikers Guide to Container Security - Automotive Edition 2024") - [Ecosystem of tooling and future capabilities of eBPF](https://www.wearedevelopers.com/videos/1199-into-the-hive-of-ebpf) (from "Into the hive of eBPF!") - [Practical use cases covering networking and performance profiling](https://www.wearedevelopers.com/videos/1199-into-the-hive-of-ebpf) (from "Into the hive of eBPF!") ## Related Articles - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 132 - Binging WADFlix?](https://www.wearedevelopers.com/magazine/473-dev-digest-132-binging-wadflix) ## Related Jobs - [Developer Embedded Linux](https://www.wearedevelopers.com/jobs/ext/381560-developer-embedded-linux) at **ZEISS Group** - [Developer Embedded Linux](https://www.wearedevelopers.com/jobs/ext/1543045-developer-embedded-linux) at **ZEISS Group** - [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio** - [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH** - [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1306782-endpoint-security-engineer-ot) at **ZEISS Group** - [Devops Engineer](https://www.wearedevelopers.com/jobs/ext/1940926-devops-engineer) at **Bitpanda**