eBPF allows you to run custom sandboxed code inside the Linux kernel without modifying kernel source code or loading modules.
An operating system is divided into user space for applications and kernel space for core functions, with system calls acting as the interface.
eBPF provides a safer and more dynamic way to run code in the kernel compared to recompiling the kernel or writing unstable kernel modules.
An eBPF program written in C is compiled to bytecode, loaded into the kernel, and executed by a virtual machine when a specific event occurs.
This code walkthrough demonstrates how to write a C program that uses a ring buffer map to capture process ID and name on creation.
Learn how to use the Cilium eBPF library in Go to generate bindings, load the eBPF object, and attach it to a kernel probe (Kprobe).
Understand the role of different hook types like Kprobes and map types like ring buffers for attaching to events and sharing data.
This example shows how to use an XDP hook and an LRU hash map to efficiently count incoming IP packets directly from the network interface.
Discover how open-source projects like Cilium and companies like Edge Delta use eBPF for Kubernetes networking, security, and observability.
09:03Ayesha Kaleem
28:20Mohammed Aboullaite
56:19Frank Müller
30:57Önder Ceylan
29:15Onur Gumus
30:58Edoardo Dusi
30:51Soroosh Khodami
21:49Reinhard Kugler
Jobs that call for the skills explored in this talk.
iits-consulting GmbH
München, Germany
Peter Park System GmbH
München, Germany
SYSKRON GmbH
Regensburg, Germany
Peter Park System GmbH
München, Germany
e.solutions GmbH