Deep Dive into eBPF: Tracing Kernel Functions for Performance Analysis
A practical deep dive into eBPF kernel tracing, covering function hooking, map-based data collection, and real-world performance profiling patterns.
Ebpf
Inside eBPF: Extending the Linux Kernel with User-Space Efficiency
eBPF lets you run sandboxed programs inside the kernel without modifying source code or loading kernel modules. This post explores its architecture, verification pipeline, and how teams use it for observability, networking, and security at scale.
Implementing eBPF for Granular Seccomp Filtering in Rootless Podman Containers
A practical guide to layering eBPF programs on top of seccomp filters for fine-grained syscall control inside rootless Podman containers. Walks through architecture, BPF CO-RE programs, seccomp notifier hooks, and production patterns.
Inside eBPF and Cilium: How Kernel-Level Filtering Rewrites Container Networking
How eBPF and Cilium move packet filtering from user-space daemons into the Linux kernel itself — and why that rewrites the rules for Kubernetes networking performance, observability, and security.
Designing eBPF-Based Telemetry Pipelines for Constrained Embedded Linux Devices
How to design and ship eBPF-based telemetry pipelines on constrained embedded Linux devices — covering CO-RE, ring buffers, perf events, and the patterns that survive contact with 32 MB RAM and flaky flash.