Inside eBPF: Tracing Kernel Events with Minimal Overhead
eBPF programs run directly in the kernel, letting you attach tracing probes to hundreds of events without modifying kernel source or paying the cost of traditional tracing tools.
Linux Kernel
Deep Dive into eBPF Program Verification in the Linux Kernel
An in-depth look at the eBPF program verifier — the component that makes it safe to run untrusted bytecode inside the Linux kernel, covering its architecture, type system, and real-world implications.
Inside eBPF: Extending the Linux Kernel with User-Space Efficiency
eBPF lets you run sandboxed programs inside the kernel without modifying source code or loading kernel modules. This post explores its architecture, verification pipeline, and how teams use it for observability, networking, and security at scale.
Designing Lock-Free Queues: Inside the Linux KFIFO and Ringbuffer Implementations
How the Linux kernel’s KFIFO achieves a wait-free, lock-free FIFO with a single atomic variable. We walk through the ringbuffer math, the memory-ordering subtlety that makes it correct on weakly ordered CPUs, and what you can borrow for your own high-throughput pipelines.
Inside eBPF and Cilium: How Kernel-Level Filtering Rewrites Container Networking
How eBPF and Cilium move packet filtering from user-space daemons into the Linux kernel itself — and why that rewrites the rules for Kubernetes networking performance, observability, and security.