A Beginner's Guide to eBPF
github.com
A Beginner's Guide to eBPF
1–10 of 78 posts
Re: A Beginner's Guide to eBPF
#2The entire first page begs the question -- "what is eBPF?"
Re: A Beginner's Guide to eBPF
#3The entire first page begs the question -- "what is eBPF?"
It's actually answered (indirectly) on that page:
"My report "What is eBPF?" and in-depth book "Learning eBPF" are both available for download [0] from Isovalent or with your subscription to O'Reilly's learning platform. You can buy "Learning eBPF" from any good bookstore (support your local bookshop by ordering it there!)"
IIUC, you need to give contact info on that page to get the PDF. So this [1] might be a better starting point.
[0] https://isovalent.com/ebpf/
[1] https://ebpf.io/
Re: A Beginner's Guide to eBPF
#4The entire first page begs the question -- "what is eBPF?"
Is a joke going over my head here, because the first sentence links to a document titled "what is eBPF?"
Re: A Beginner's Guide to eBPF
#5Looks like a "buy my book" ad to me...
Re: A Beginner's Guide to eBPF
#6The entire first page begs the question -- "what is eBPF?"
After looking at the link first, this comment cracked me up. I skimmed most of the GH content without figuring out the answer; I wasn't going to click an O'Reilly link. So I gave up. Then my OCD kicked in and I got annoyed with myself for giving up, since if I'm going to waste time on HN I should really get to the bottom of things. So searched it. I found this:
It runs sandboxed kernel extensions? Or it's a VM? Something like that? The writing of the page itself doesn't inspire a lot of confidence, but then maybe it's just over my head.
Re: A Beginner's Guide to eBPF
#7This is not eBNF. That is something completely different.
Re: A Beginner's Guide to eBPF
#8https://ebpf.io/what-is-ebpf/ is quite useful.
Re: A Beginner's Guide to eBPF
#9The GitHub page linked here mentions the word “eBPF” 18 times and yet not once does it expand on what this abbreviation means.
Re: A Beginner's Guide to eBPF
#10This may prove useful:
> eBPF (often aliased BPF)[2][5] is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.[6] It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.[7] Safety is provided through an in-kernel verifier which performs static code analysis and rejects programs which crash, hang or otherwise interfere with the kernel negatively.[8][9] Examples of programs that are automatically rejected are programs without strong exit guarantees (i.e. for/while loops without exit conditions) and programs dereferencing pointers without safety-checks.[10] Loaded programs which passed the verifier are either interpreted or in-kernel JIT compiled for native execution performance. The execution model is event-driven and with few exceptions run-to-completion,[2] meaning, programs can be attached to various hook points in the operating system kernel and are run upon triggering of an event. eBPF use cases include (but are not limited to) networking such as XDP, tracing and security subsystems.[6] Given eBPF's efficiency and flexibility opened up new possibilities to solve production issues, Brendan Gregg famously coined eBPF as "superpowers for Linux".[11] Linus Torvalds expressed that "BPF has actually been really useful, and the real power of it is how it allows people to do specialized code that isn't enabled until asked for".[12] Due to its success in Linux, the eBPF runtime has been ported to other operating systems such as Windows.[4]