eCHO - eBPF & Cilium Office Hours

Currently Playing: eCHO episode 136: How Does eBPF Actually Work?

You’ve seen the eBPF architecture diagram many times now in presentations: “…and then we compile some C code and attach it to a function in the kernel…”, before moving on. Have you ever wondered what that really means and what actually happens when you do that? This talk is for you. We’ll take a simple eBPF program and step through everything that happens to it. How it’s compiled, what is eBPF bytecode and what it looks like, how the kernel loads it, how the verifier works, how the JIT compiles it and what to, and finally how the kernel hooks its own function calls with the compiled eBPF. At each step, we’ll follow through our example, from source code to eBPF byte code, to JIT-compiled for the running platform. We’ll investigate some relevant parts of the Linux kernel source code, and learn what’s really happening when you run eBPF code. Whether you are just starting to learn about eBPF, you're looking for further material or you're a seasoned contributor to major eBPF projects, the eBPF & Cilium Community is here to support you. Join the community on Slack 24/7 for help with, and discussions about eBPF and Cilium: https://ebpf.io/slack. —- Cilium is an open source software for providing, securing and observing network connectivity between container workloads - cloud native, and fueled by the revolutionary Kernel technology eBPF. Learn more on the website: https://cilium.io/ Follow us on Twitter: https://twitter.com/ciliumproject Download and contribute on Github: https://github.com/cilium/cilium —- eBPF is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in an operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules. Learn more on the website: https://ebpf.io/ #ebpf #cilium #cloudnative