eBPF
eBPF (extended Berkeley Packet Filter) is a Linux kernel technology that lets sandboxed programs run directly inside the kernel, triggered by events like system calls, network packets, or function entry/exit, without modifying kernel…
Definition
eBPF (extended Berkeley Packet Filter) is a Linux kernel technology that lets sandboxed programs run directly inside the kernel, triggered by events like system calls, network packets, or function entry/exit, without modifying kernel source code or loading traditional kernel modules.
Overview
eBPF evolved from the original BPF, a mechanism from the early 1990s for efficient packet filtering (used by tools like tcpdump). Over the 2010s, Linux kernel developers extended it into a general-purpose, verified execution environment: eBPF programs are written in a restricted C-like subset, compiled to eBPF bytecode, and loaded into the kernel where an in-kernel verifier statically proves they cannot crash, hang, or corrupt memory before allowing them to run — no traditional kernel module compilation, unsafe pointer access, or system reboot required. Once loaded, eBPF programs attach to hook points throughout the kernel — network interfaces (XDP for ultra-fast packet processing), system calls, kernel and user-space function entry/exit (kprobes/uprobes), tracepoints, and cgroups — and can inspect, modify, or drop data, or simply collect metrics, communicating results back to user space via efficient data structures called eBPF maps. A JIT compiler translates the bytecode to native machine code for near-native execution speed. This architecture unlocked a wave of new tooling across networking, observability, and security without the risk and friction of custom kernel modules. Cilium uses eBPF for high-performance Kubernetes networking and network policy enforcement, replacing much of the traditional iptables-based data path. Observability tools like Pixie, Parca, and Grafana's Beyla use eBPF to auto-instrument applications and capture metrics, traces, and profiles without code changes. Security tools like Falco and Tetragon use eBPF to detect and block suspicious kernel-level behavior in real time. eBPF is Linux-specific (Windows has an experimental eBPF port), and while enormously powerful, writing raw eBPF programs remains a specialized, low-level skill — most practitioners interact with it through higher-level frameworks and pre-built tools rather than writing eBPF bytecode by hand.
Key Concepts
- Runs sandboxed programs inside the Linux kernel without kernel modules or reboots
- In-kernel verifier statically proves programs are safe before allowing execution
- JIT-compiled to native machine code for near-native performance
- Attaches to hooks: network interfaces (XDP), syscalls, kprobes/uprobes, tracepoints, cgroups
- eBPF maps provide efficient kernel-to-user-space data exchange
- Powers high-performance Kubernetes networking (Cilium) beyond traditional iptables
- Enables zero-instrumentation observability (Pixie, Grafana Beyla, Parca)
- Used for real-time kernel-level security enforcement (Falco, Tetragon)