eBPF: Run Sandboxed Programs in the Linux Kernel
eBPF lets you run sandboxed programs directly in the Linux kernel, like adding programmable event handlers to your OS. This enables high-performance networking, security, and observability without changing kernel code.
Why it exists
Before eBPF, observing or modifying kernel behavior required changing kernel source code or loading kernel modules. Both are slow, risky processes; a bug in a kernel module can crash the entire system. This made innovation in areas like networking and security difficult and dangerous.
The mental model
Think of eBPF as a small, safe virtual machine inside the Linux kernel. You attach small, event-driven programs to hooks, like a network packet arriving or a system call being made. The kernel verifies your program is safe, then runs it with near-native performance. It's like adding secure, user-defined functions to the kernel's API without recompiling the kernel.
How it works
A developer writes an eBPF program, usually in a restricted form of C, and compiles it to eBPF bytecode. When loaded, the kernel's verifier statically analyzes the code to ensure it cannot crash the system—it checks for infinite loops and illegal memory access. If verified, the program is Just-In-Time (JIT) compiled to native machine code and attached to a hook point. These programs can then collect data, modify behavior, and communicate with user-space applications via special data structures called eBPF maps.
When to use it
Use eBPF for high-performance, programmable visibility and control at the kernel level. It is the engine behind many modern cloud-native tools. Key use cases include: high-performance networking and load balancing (Cilium, Katran), runtime security enforcement (Tetragon, Falco), and deep system tracing and profiling (bpftrace, Parca). It excels where user-space tools are too slow or lack kernel context.
When not to use it
Do not use eBPF for general application logic. The programs are intentionally limited in complexity and cannot perform blocking operations. If your logic doesn't require kernel-level performance or context, a standard user-space process is the correct choice. eBPF is also a Linux-specific technology and is not a solution for cross-platform instrumentation.
One canonical example
Cilium provides Kubernetes networking and security using eBPF. Instead of traditional iptables rules, Cilium attaches eBPF programs to network devices. When a packet arrives, an eBPF program can instantly make an identity-based security decision and forward the packet, bypassing much of the kernel's slower networking stack. This provides a significant performance boost and enables more granular security policies.
Interview question
Which mechanism is primarily responsible for preventing eBPF programs from crashing the Linux kernel?
- a.Programs are limited to a safe subset of C, which inherently prevents system-crashing operations.
- b.eBPF programs are executed in a user-space sandbox, isolated from kernel memory.
- c.The kernel's verifier statically analyzes the eBPF bytecode for safety before loading.Correct
- d.The Just-In-Time (JIT) compiler optimizes code to avoid runtime errors.
Why? this is the answer
The card states that the kernel's verifier statically analyzes the code to ensure it cannot crash the system by checking for infinite loops and illegal memory access. While the restricted C dialect aids in writing safe code, the verifier is the active component that enforces safety. JIT compilation occurs after verification and focuses on performance, not crash prevention.
Just read this? Test yourself on what you have been reading.
Read the original → ebpf.io
- #ebpf
- #linux
- #kernel
- #observability
- #networking
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles