A practical guide to layering eBPF programs on top of seccomp filters for fine-grained syscall control inside rootless Podman containers. Walks through architecture, BPF CO-RE programs, seccomp notifier hooks, and production patterns.
How eBPF and Cilium move packet filtering from user-space daemons into the Linux kernel itself — and why that rewrites the rules for Kubernetes networking performance, observability, and security.
How to design and ship eBPF-based telemetry pipelines on constrained embedded Linux devices — covering CO-RE, ring buffers, perf events, and the patterns that survive contact with 32 MB RAM and flaky flash.
TL;DR — eBPF lets you load and run sandboxed bytecode inside the Linux kernel at near-native speed, attached to hooks like network events, syscalls, and tracepoints. A static verifier guarantees the program terminates and stays safe before a JIT compiler turns it into machine code, which is why tools like Cilium, Pixie, and bpftrace have reshaped observability and networking in production. If you’ve shipped a service on Linux in the last five years, you’ve almost certainly been touched by eBPF — even if you never wrote a program yourself. Cilium powers the networking and service mesh layer for hyperscalers like AWS and Shopify. Datadog and New Relic ship kernel probes for zero-instrumentation tracing. Cloudflare uses eBPF to do connection tracking and DDoS mitigation at line rate. The reason this is possible is a piece of kernel machinery that turns “the kernel is a closed black box” into “the kernel is a programmable, observable, auditable system,” without compromising its stability. ...
Build a production-shaped eBPF/XDP packet classifier from scratch in C. Real code, real architecture, and a clear roadmap to extend it into a senior-level systems project.