eBPF (which is no longer an acronym for anything) is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in a privileged context such as the operating system kernel. It has been used in production for over half a decade at scales from small deployments up to hyperscale cloud operations across billions of devices. eBPF can safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules, while significantly speeding time to market.

Below you will find a variety of resources to help you get started with or make the most out of using eBPF.

• The State of eBPF Report – January 2024

• Unlocking the Kernel – the eBPF Documentary

• BPF & XDP Reference Guide
  Cilium Documentation, Aug 2020
• BPF Documentation
  BPF Documentation in the Linux Kernel
• BPF Design Q&A
  FAQ for kernel-related eBPF questions

• Learning eBPF
  Liz Rice
• Getting started with eBPF
  Instruqt
• Compiler Explorer
  Intel, SolidSands, SonarCloud
• Learn eBPF Tracing: Tutorial and Examples
  Brendan Gregg’s Blog, Jan 2019
• XDP Hands-On Tutorials
  Various authors, 2019
• BCC, libbpf and BPF CO-RE Tutorials
  Facebook’s BPF Blog, 2020

• Introduction to Cilium (LFS146x) – FREE
  Linux Foundation Training & Certification

• Generic

  • How the Hive Came to Bee – A Technical Deep Dive of eBPF
    Daniel Borkmann, Isovalent Webinar, Dec 2022
  • A Beginners Guide to eBPF Programming for Networking
    Liz Rice, Cloud Native eBPF Day, Oct 2021
  • A Beginner’s Guide to eBPF Programming with Go
    Liz Rice, GOTOpia, Feb 2021
  • eBPF and Kubernetes: Little Helper Minions for Scaling Microservices (Slides)
    Daniel Borkmann, KubeCon EU, Aug 2020
  • eBPF – Rethinking the Linux Kernel (Slides)
    Thomas Graf, QCon London, April 2020
  • BPF as a revolutionary technology for the container landscape (Slides)
    Daniel Borkmann, FOSDEM, Feb 2020
  • BPF at Facebook
    Alexei Starovoitov, Performance Summit, Dec 2019
  • BPF: A New Type of Software (Slides)
    Brendan Gregg, Ubuntu Masters, Oct 2019
  • The ubiquity but also the necessity of eBPF as a technology
    David S. Miller, Kernel Recipes, Oct 2019

  Deep Dives

  • BPF and Spectre: Mitigating transient execution attacks (Slides)
    Daniel Borkmann, eBPF Summit, Aug 2021
  • BPF Internals (Slides)
    Brendan Gregg, USENIX LISA, Jun 2021

  Cilium

  • Advanced BPF Kernel Features for the Container Age (Slides)
    Daniel Borkmann, FOSDEM, Feb 2021
  • Kubernetes Service Load-Balancing at Scale with BPF & XDP (Slides)
    Daniel Borkmann & Martynas Pumputis, Linux Plumbers, Aug 2020
  • Liberating Kubernetes from kube-proxy and iptables (Slides)
    Martynas Pumputis, KubeCon US 2019
  • Understanding and Troubleshooting the eBPF Datapath in Cilium (Slides)
    Nathan Sweet, KubeCon US 2019
  • Transparent Chaos Testing with Envoy, Cilium and BPF (Slides)
    Thomas Graf, KubeCon EU 2019
  • Cilium – Bringing the BPF Revolution to Kubernetes Networking and Security (Slides)
    Thomas Graf, All Systems Go!, Berlin, Sep 2018
  • How to Make Linux Microservice-Aware with eBPF (Slides)
    Thomas Graf, QCon San Francisco, 2018
  • Accelerating Envoy with the Linux Kernel
    Thomas Graf, KubeCon EU 2018
  • Cilium – Network and Application Security with BPF and XDP (Slides)
    Thomas Graf, DockerCon Austin, Apr 2017

  Hubble

  • Hubble – eBPF Based Observability for Kubernetes
    Sebastian Wicki, KubeCon EU, Aug 2020

• O’Reilly Book – Learning eBPF
  Liz Rice, O’Reilly, Mar 2023
• O’Reilly Book – Security Observability with eBPF
  Natália Réka Ivánkó and Jed Salazar, O’Reilly, Apr 2022
• O’Reilly Report – What is eBPF?
  Liz Rice, O’Reilly, Apr 2022
• Systems Performance: Enterprise and the Cloud, 2nd Edition
  Brendan Gregg, Addison-Wesley Professional Computing Series, 2020
• BPF Performance Tools
  Brendan Gregg, Addison-Wesley Professional Computing Series, Dec 2019
• Linux Observability with BPF
  David Calavera, Lorenzo Fontana, O’Reilly, Nov 2019