eBPF
Also known as: Extended Berkeley Packet Filter
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is eBPF?
eBPF is a Linux kernel technology for safely running verified programs in response to kernel and application events. This profile connects the concept to KBY's practical engineering guidance.
eBPF programs attach to hooks in networking, tracing, security and scheduling without requiring a custom kernel module. A verifier constrains program behaviour, while maps exchange data with user space, enabling high-performance observability and policy enforcement.
Extend Linux observability, networking and security with programmable kernel hooks.
- High-performance networking
- Kernel-level observability
- Security policy enforcement without kernel modules
Explore related technologies
Parent technology
2 resources for eBPF
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with eBPF
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(2)
Start here: understand the core vocabulary.