This article introduces eBPF fundamentals, explains the Compile‑Once‑Run‑Everywhere (CO‑RE) approach, compares it with traditional eBPF, outlines best practices, and walks through a complete Go‑based example using the Cilium/eBPF library and the eunomia‑bpf runtime.
This article walks through constructing pure‑C eBPF programs using the native libbpf library, covering kernel‑libbpf version mapping, environment setup for RPM and DEB systems, detailed Makefile analysis, embedding BPF objects via hexdump, and extending the approach to USDT and Uprobe tracing without relying on libbpf‑bootstrap.
The article walks through libbpf’s step‑by‑step process for opening the vfsstat.bpf.o ELF object, validating options, parsing ELF headers, collecting sections, initializing maps and programs, and preparing the eBPF program for later kernel loading and attachment.
This article introduces eBPF as a register‑based virtual machine inside the Linux kernel, explains its non‑Turing‑complete design, shows how programs are loaded, verified, and attached to events, and provides a complete C example that counts TCP, UDP, and ICMP packets on a loopback interface.
