Learning eBPF

Learning eBPF is a practical guide to eBPF, a technology that lets people add their own programs to the kernel, so its behaviour can be altered while it runs. The book explains how eBPF works inside the system. It treats eBPF as a base for a fresh wave of tools in three areas: security, observability and networking. Those three areas are its main themes. The book is written for anyone curious about the topic, including developers, system administrators, operators and students.

Why You Should Read?

• Learn how eBPF works through a practical approach written for curious readers.
• Understand how your own code can change what the kernel does as it runs.
• Explore how eBPF opens the way to new tools for security, observability and networking work.
• Gain a practical book that suits developers, system administrators, operators and students alike.