Demystifying eBPF

In cloud infrastructure, understanding performance bottlenecks usually requires injecting sidecars or scraping logs. However, extended Berkeley Packet Filter (eBPF) lets us run sandboxed programs directly inside the Linux kernel without changing kernel source code or loading loaded modules.

This revolutionizes systems observability, traffic routing, and runtime security.

How eBPF Works

When an event occurs (e.g. system calls, network packet arrival, or tracepoints), the attached eBPF program executes inside a sandboxed VM in the kernel. Before executing, the kernel verifier checks that the bytecode is completely safe:

It has no loops (or bounded loops that compile safely).
It never accesses invalid memory zones.
It is guaranteed to terminate quickly to prevent kernel lockup.

code compiler

┌───────────────────────────────────────┐
│              User Space               │
│  ┌─────────────────┐                  │
│  │   Go/Rust App   │ ◄─────────────┐  │
│  └────────┬────────┘               │  │
└───────────┼────────────────────────┼──┘
            │ load bytecode          │ read via eBPF Map
┌───────────┼────────────────────────┼──┘
│           ▼                        │  │
│  ┌─────────────────┐        ┌──────┴┐ │
│  │ eBPF Verifier   │        │ eBPF  │ │
│  └────────┬────────┘        │ Map   │ │
│           ▼                 └──────┬┘ │
│  ┌─────────────────┐               ▲  │
│  │  Kernel Engine  │ ──────────────┘  │
│  └────────┬────────┘                  │
│           ▼                           │
│     [Syscalls / Trace]                │
│              Kernel Space             │
└───────────────────────────────────────┘

A Basic Syscall Tracer in C

Here is a basic eBPF program that monitors the sys_enter_execve syscall (executed when executing a new program):

code compiler

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("tracepoint/syscalls/sys_enter_execve")
int bpf_prog(void *ctx) {
    char msg[] = "Syscall execve captured!\n";
    bpf_trace_printk(msg, sizeof(msg));
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

Reading Maps from Go

To communicate between the kernel space and your user space application, eBPF uses Maps (key/value structures). Here is a snippet of how a Go application reads from a ring buffer map:

code compiler

package main

import (
	"log"
	"github.com/cilium/ebpf"
	"github.com/cilium/ebpf/link"
)

func main() {
	// Loading pre-compiled objects
	objs := bpfObjects{}
	if err := loadBpfObjects(&objs, nil); err != nil {
		log.Fatalf("failed loading objects: %v", err)
	}
	defer objs.Close()

	// Link to tracepoint
	tp, err := link.Tracepoint("syscalls", "sys_enter_execve", objs.BpfProg, nil)
	if err != nil {
		log.Fatalf("failed linking tracepoint: %v", err)
	}
	defer tp.Close()

	log.Println("Listening for syscall hooks...")
}

By removing the reliance on application-level tracing, eBPF lets us observe high-throughput clusters with near-zero performance degradation.