Ebpf

TL;DR — eBPF lets you load and run sandboxed bytecode inside the Linux kernel at near-native speed, attached to hooks like network events, syscalls, and tracepoints. A static verifier guarantees the program terminates and stays safe before a JIT compiler turns it into machine code, which is why tools like Cilium, Pixie, and bpftrace have reshaped observability and networking in production. If you’ve shipped a service on Linux in the last five years, you’ve almost certainly been touched by eBPF — even if you never wrote a program yourself. Cilium powers the networking and service mesh layer for hyperscalers like AWS and Shopify. Datadog and New Relic ship kernel probes for zero-instrumentation tracing. Cloudflare uses eBPF to do connection tracking and DDoS mitigation at line rate. The reason this is possible is a piece of kernel machinery that turns “the kernel is a closed black box” into “the kernel is a programmable, observable, auditable system,” without compromising its stability. ...

Build a production-shaped eBPF/XDP packet classifier from scratch in C. Real code, real architecture, and a clear roadmap to extend it into a senior-level systems project.

A practical architecture guide to running Istio Ambient Mode across multiple Kubernetes clusters, with eBPF-powered data planes handling L4 and waypoint proxies owning L7.

A practical guide to integrating eBPF into production observability stacks, with architecture diagrams, code snippets, and lessons from large‑scale deployments.

A deep dive into eBPF‑based tracing, showing how to design a production‑grade observability stack, measure its impact, and apply battle‑tested patterns.