#eBPF

Articles about eBPF — exploring patterns, best practices, and real-world implementations in production systems.

8 posts tagged with ebpf. ← All posts

#A2A (14)#ADK (8)#AG-UI (6)#AI (9)#AI Agents (311)#AI Architecture (21)#AI Cost (10)#AI Cost Optimization (8)#AI Engineering (227)#AI Evaluation (9)#AI Gateway (8)#AI Governance (29)#AI Red Teaming (9)#AI Research (9)#AI Safety (8)#AI Security (29)#AI in Production (12)#AML (3)#API Design (10)#API Security (8)#APIs (56)#AWS (17)#Accounting (9)#Agent Skills (3)#Agentic AI (24)#Agentic Commerce (12)#Agentic RAG (8)#Agents (4)#Amazon Bedrock (8)#Analytics (3)#Architecture (40)#Audit (3)#Authentication (11)#Authorization (3)#Automation (8)#Azure (11)#Azure AI Foundry (9)#Backend Engineering (310)#Benchmarks (3)#Best Practices (3)#BigQuery (6)#Business Finance (8)#Business Strategy (55)#C (8)#CI/CD (16)#Caching (11)#Capital Markets (14)#Card Payments (12)#Cards (13)#Career (25)#Checkpointing (4)#Claude Code (8)#Cloud (5)#Cloud Architecture (3)#Cloud Native (10)#Code Review (8)#Collaboration (5)#Communication (9)#Compliance (52)#Computer Networking (9)#Computer Science (32)#Computer Vision (5)#Concurrency (39)#Consulting (3)#Containers (10)#Context Engineering (10)#Conversational AI (8)#Cost Optimisation (5)#Credit (14)#Credit Risk (14)#CrewAI (8)#Crypto (12)#Cryptocurrency (12)#Cryptography (8)#Custody (9)#DSPy (8)#Data (13)#Data Engineering (12)#Data Structures (9)#Databases (38)#Deployment (4)#Design Patterns (10)#DevOps (24)#DevSecOps (21)#Developer Experience (5)#Developer Tools (5)#Distributed Systems (95)#Documentation (3)#Edge AI (8)#Embeddings (17)#Emotional Intelligence (8)#Energy (8)#Engineering (11)#Engineering Culture (3)#Engineering Practices (16)#Error Handling (4)#Evaluation (58)#Event-Driven Architecture (8)#FREE-AI (8)#FX (5)#Feedback (4)#FinOps (23)#FinTech (6)#Financial AI (14)#Financial Systems (129)#Fine-Tuning (11)#Fintech (131)#Flutter (8)#Foreign Exchange (5)#Forward Deployed Engineer (16)#Forward Deployed Engineering (8)#Fraud (10)#Function Tools (5)#Functional Programming (3)#Fundraising (8)#GCP (5)#Gemma (4)#Generative AI (3)#Git (8)#Go (220)#Go-to-Market (8)#Google ADK (36)#Governance (59)#Granite (6)#GraphQL (3)#Growth (3)#Guardrails (33)#HIPAA (3)#HTTP (3)#Harness Engineering (8)#Hiring (8)#Hugging Face (8)#Human-in-the-Loop (9)#IBM watsonx (8)#Identity (11)#Integration (3)#Intellectual Property (8)#Interfaces (3)#JavaScript (8)#KYC (11)#KYC and AML (12)#Kafka (10)#Kubernetes (17)#LLM (5)#LLM Inference (8)#LLM Infrastructure (8)#LLM-as-Judge (3)#LLMs (170)#LangChain (8)#LangGraph (11)#Leadership (26)#Ledger (12)#Legal (8)#Lending (14)#Linux (9)#LlamaIndex (8)#Load Balancing (3)#MCP (22)#MLOps (32)#Machine Learning (49)#Marketing (16)#Markets (4)#Memory (15)#Memory Management (5)#Metrics (6)#Microservices (3)#Microsoft Agent Framework (150)#Middleware (6)#Migration (9)#Mixture of Experts (5)#Monitoring (3)#Multi-Agent (10)#Multi-Agent AI (14)#Multi-Agent Systems (73)#Multimodal (3)#Multimodal AI (8)#NIM (5)#NVIDIA (8)#Networking (3)#OAuth (3)#OWASP (7)#Observability (49)#On-Device AI (8)#Open Source (7)#OpenTelemetry (5)#Operating Systems (9)#Operations (10)#Opinion (6)#Orchestration (10)#Organizational Design (8)#Payment Rails (16)#Payments (54)#People (8)#Performance (48)#Personalization (9)#Platform Engineering (9)#PreSales (8)#Privacy (5)#Privacy Engineering (3)#Process (4)#Product (29)#Product Management (8)#Production (11)#Programming (10)#Programming Languages (48)#Prompt Engineering (74)#Prompt Injection (14)#Protocol Buffers (3)#Protocols (9)#Providers (4)#Pydantic AI (8)#Python (142)#Quality (3)#RAG (59)#RBI (3)#REST (5)#Rails (16)#Reasoning Models (8)#Recommender Systems (8)#Reconciliation (3)#RegTech (8)#Regulation (9)#Reliability (52)#Resilience (4)#Responsible AI (5)#Retrieval (3)#Risk (13)#Rust (32)#SLSA (3)#SRE (22)#Sales (9)#Scalability (3)#Security (91)#Security Engineering (8)#Self-Evolving Agents (16)#Sessions (3)#Settlement (9)#Soft Skills (8)#Software (3)#Software Architecture (36)#Software Delivery (9)#Software Engineering (144)#Spanner (4)#Speech (8)#Startups (30)#Strands (8)#Streaming (31)#Structured Output (4)#Supply Chain Security (9)#Sustainability (8)#System Design (32)#Systems Programming (56)#Testing (53)#Threat Modeling (3)#Tool Use (22)#Tooling (5)#Tools (3)#Trading (8)#Treasury (6)#Type System (3)#Type Systems (11)#TypeScript (8)#Vector Databases (22)#Vector Search (11)#Venture Capital (8)#Version Control (8)#Voice AI (9)#Web Development (6)#Workflows (14)#eBPF (8)#gRPC (13)#smolagents (8)
Pratik Dhanave · ·6 min read

The eBPF Ecosystem and Building With It

You rarely write raw eBPF bytecode by hand — a rich ecosystem of libraries, languages, and platforms sits on top, and one breakthrough (CO-RE) solved the portability problem that once made eBPF programs fragile across kernel versions. This closing post surveys how you actually build with eBPF, and where the technology is heading.

You rarely write raw eBPF bytecode by hand — a rich ecosystem of libraries, languages, and platforms sits on top, and one breakthrough (CO-RE, Compile Once Run Everywhere) solved the portability problem that once made eBPF programs fragile across kernel versions. This closing post surveys how you actually build with eBPF, and where it's heading.

#eBPF#Linux#Systems Programming#Tooling
Pratik Dhanave · ·6 min read

eBPF for Security

Security is eBPF's third domain, and arguably its most natural fit: the kernel sees every syscall, every process, every file access and network connection, so an eBPF program in the kernel is perfectly positioned to watch for and stop malicious behavior in real time. This is why modern runtime-security tools — detecting and blocking threats on live systems — are increasingly built on eBPF.

Security is eBPF's most natural fit: the kernel sees every syscall, process, file access, and network connection, so an eBPF program in the kernel is perfectly positioned to watch for and stop malicious behavior in real time. This is why modern runtime-security tools — detecting and blocking threats on live systems — are increasingly built on eBPF.

#eBPF#Security#Linux#DevSecOps#Systems Programming
Pratik Dhanave · ·5 min read

eBPF for Networking

Networking is where eBPF delivers its most dramatic performance wins. By running packet-processing logic in the kernel — at the earliest possible moment a packet arrives, before the kernel even builds its usual data structures — eBPF can filter, route, and load-balance at speeds user-space networking can't touch. It's why the networking layer of modern cloud-native infrastructure is increasingly eBPF underneath.

Networking is where eBPF delivers its most dramatic performance wins. By running packet-processing logic in the kernel — at the earliest moment a packet arrives, before the kernel builds its usual data structures — eBPF can filter, route, and load-balance at speeds user-space networking can't touch. It's why modern cloud-native networking is increasingly eBPF underneath.

#eBPF#Networking#Linux#Performance#Systems Programming
Pratik Dhanave · ·5 min read

eBPF for Observability

Observability is where eBPF first went mainstream, and for good reason: it lets you see almost anything the kernel sees — syscalls, function calls, network events, disk I/O — with very low overhead and, crucially, without changing the code you're observing. That combination broke a long-standing trade-off in tracing and profiling, and it's why modern observability tools are increasingly built on eBPF.

Observability is where eBPF first went mainstream: it lets you see almost anything the kernel sees — syscalls, function calls, network events, disk I/O — with very low overhead and, crucially, without changing the code you're observing. That combination broke a long-standing trade-off in tracing and profiling, and it's why modern observability tools are increasingly built on eBPF.

#eBPF#Observability#Linux#Performance#Systems Programming#Reliability
Pratik Dhanave · ·6 min read

The Verifier and Safety

The verifier is the reason eBPF exists in its modern form. Running arbitrary code in the kernel would be reckless; running code the kernel has proven safe is not. The verifier is the static analyzer that stands between your program and the kernel, mathematically checking that it can't crash, hang, or misbehave — and understanding it explains both eBPF's safety and its constraints.

The verifier is the reason eBPF exists in its modern form. Running arbitrary code in the kernel would be reckless; running code the kernel has proven safe is not. The verifier is the static analyzer that stands between your program and the kernel, mathematically checking it can't crash, hang, or misbehave — and it explains both eBPF's safety and its constraints.

#eBPF#Linux#Security#Systems Programming
Pratik Dhanave · ·6 min read

How eBPF Works: Programs, Hooks, Maps

An eBPF program's journey — from code you write to logic running in the kernel — has a few distinct pieces: the program itself, the hook it attaches to, the maps it uses to share data, and the load path that gets it safely into the kernel. Once you can name these four things and see how they fit together, eBPF stops being magic and becomes a system you can reason about.

An eBPF program's journey — from code you write to logic running in the kernel — has a few distinct pieces: the program, the hook it attaches to, the maps it uses to share data, and the load path that gets it safely into the kernel. Once you can name these four things and see how they fit, eBPF stops being magic. With an interactive architecture diagram.

#eBPF#Linux#Systems Programming#Architecture
Pratik Dhanave · ·5 min read

The Kernel/User-Space Boundary

To understand why eBPF is such a big deal, you have to understand the wall it lets you cross: the boundary between user space and the kernel. That boundary exists for good reasons — safety and isolation — but it also meant that extending the kernel was historically a choice between two bad options. eBPF is the third option nobody had before.

To understand why eBPF is a big deal, you have to understand the wall it lets you cross: the boundary between user space and the kernel. That boundary exists for good reasons — safety and isolation — but it meant extending the kernel was a choice between two bad options: a dangerous kernel module or a limited user-space workaround. eBPF is the third option nobody had before.

#eBPF#Linux#Operating Systems#Systems Programming
Pratik Dhanave · ·5 min read

What eBPF Is, and Why It Matters

eBPF lets you run your own sandboxed programs inside the Linux kernel, safely, without changing kernel source or loading a risky module — and that quietly unlocks a new generation of observability, networking, and security tools. It's one of the most consequential systems technologies of the last decade, and it's worth understanding from first principles. This series builds eBPF up from the problem it solves.

eBPF lets you run your own sandboxed programs inside the Linux kernel, safely, without changing kernel source or loading a risky module — quietly unlocking a new generation of observability, networking, and security tools. It's one of the most consequential systems technologies of the last decade. This series builds eBPF up from the problem it solves.

#eBPF#Linux#Systems Programming#Observability#Reliability

All posts on this site are written by Pratik Dhanave, an Agentic AI Architect with 7+ years building production distributed systems, multi-agent AI platforms, and cloud-native infrastructure. About the author → Each article includes working code, architecture diagrams, and references to the specific frameworks and standards discussed. Browse all posts or explore related topics using the tag cloud above.