Skip to main content


  • Written on: Jan 6th 2022

  • While Linux is a great operating system but because of the nature of the how it is built in an open source community it is not the mostly friendly operating system out there, there are [[challenges in modifying the kernel]], adding modules and with the new AI/IoT based devices using linux, there are even more challenges in debugging, tracking, tracking and modifying.
  • Extended Berkley Packet Filter tries to solve this problem to extending, debugging the kernel by posing itself as a kernel technology which would let you extend the kernel without editing the source code or adding additional modules ( thus avoiding recompilation), it can be thought of as a lighter virtual machine linked with the kernel ( similar to the Lua JIT compiler in nginx ?) where programs can run BPF bytecode with all the kernel resources available in a single location
  • Its like a program which runs in user space, but can extend the kernel as kernel calls it and runs the bytecode in a sandbox environment . It has a JIT compiler and a verification engine.
  • You can register kernel callbacks/hooks which gets executed in user space, thus you are able to extend the kernel without the need to modify it before distributing the source.
  • It has an event driven archiecture
  • eBPFs or these hooks have to be compiled and pass the verification engine tests before they can be called by the kernel, this ensure safety and security.
  • Hence it has become one of the favourite tool to implement
    • Providing high-performance networking and load-balancing for data centres through cloud native environments.
    • Extracting security data and generate test scripts for frameworks related to Linux kernels.
  • EBPF Load Balancing by Facebook
Tracking with sBPF
  • Performance
    • It has a very high processing rate
  • The Bad Part
    • Only works with Linux ( Yay !!)
    • Will not work with Kernel < 4.13
    • Because it is sandboxed you cant just talk to other programs from it, you need everything in one place together.
  • eBPF and Kubernetes


Popular posts from this blog

It was a great experience to talk to a huge audience in Mumbai and Delhi about how to start your ML journey at Google Cloud Summit ’18 India
“ this is what 864GB of RAM looks like ” , from 37 signals