How to Build a Complete eBPF Development Environment on Ubuntu

eBPF Overview

eBPF extends the original Berkeley Packet Filter, allowing user‑defined programs to run in kernel space without modifying the kernel source or loading kernel modules. Typical use cases include packet filtering, traffic control, load balancing, system‑call monitoring, intrusion detection, kernel‑level tracing, and metric collection. The technology provides high performance (in‑kernel execution), safety (pre‑verification), and flexibility (dynamic loading).

Preparation

Any Linux machine can host eBPF programs; the only requirement is a kernel that supports eBPF (e.g., 5.15+). The reference environment uses Ubuntu 20.04.6 LTS on a mini‑host with 4 CPU cores and 8 GB RAM.

Ubuntu Packages

Install the following packages to compile and run eBPF programs. Each command is shown exactly as executed.

sudo apt install linux-headers-$(uname -r)

sudo apt install libbpfcc-dev

sudo apt install libbpf-dev

sudo apt install llvm

sudo apt install clang

sudo apt install gcc-multilib

sudo apt install build-essential

sudo apt install linux-tools-$(uname -r)

sudo apt install linux-tools-common \
                linux-tools-generic \
                linux-tools-$(uname -r)

These packages provide kernel headers, the libbpf/libbpfcc libraries, the LLVM/Clang toolchain for eBPF bytecode compilation, multi‑arch support, basic build tools, and the bpftool utility for interacting with BPF objects.

Go Toolchain

Install the latest Go from the longsleep PPA to obtain the user‑space libraries used in the tutorial.

sudo add-apt-repository ppa:longsleep/golang-backports
sudo apt update
sudo apt install golang-go

Go Packages

The project depends on the following Go modules, installed with go get:

netlink – user‑space interface to Netlink for configuring interfaces, IP addresses, routes, and IPsec. Requires root privileges for most operations.

gopacket – packet capture, decoding, and analysis library.

gopacket/layers – helpers for constructing and manipulating network‑layer headers.

cilium/ebpf – high‑level API for loading, compiling, and attaching eBPF programs, plus map access. Includes the bpf2go tool that compiles C source to eBPF bytecode and generates Go bindings.

cilium/ebpf/perf – wrapper around perf_events to deliver data from kernel‑space eBPF programs to user space via a ring buffer.

golang.org/x/sys/unix – Unix‑specific utilities (sockets, process management, etc.).

go get github.com/vishvananda/netlink
go get github.com/google/gopacket
go get github.com/google/gopacket/layers
go get github.com/cilium/ebpf
go get github.com/cilium/ebpf/perf
go get golang.org/x/sys/unix

Version Snapshot

OS: Ubuntu 20.04.6 Focal LTS

Kernel: 5.15.0‑1038

Go: 1.20.6 (linux/amd64)

cilium/ebpf: v0.11.0

gopacket: v1.1.19

netlink: v1.1.0

bpftool: v5.15.98

LLVM: 10.0.0

Clang: 10.0.0 x86_64‑pc‑linux‑gnu

GCC: 9.4.0

References

eunomia‑bpf/bpf‑developer‑tutorial – https://github.com/eunomia-bpf/bpf-developer-tutorial

Setup an eBPF Development Environment – https://thegraynode.io/posts/bpf_dev_env/

eBPF Primer – https://thegraynode.io/posts/bpf_primer/

bpftool source tree – https://github.com/torvalds/linux/tree/master/tools/bpf/bpftool