Getting Started with eBPF: Improving Observability, Networking, and Security Through Custom eBPF Programs

eBPF is a revolutionary technology that allows developers, software engineers, and security engineers to collect customized information about how an app is behaving without having to change the app in any way, by observing it from within the kernel. This makes it a powerful platform for building the next generation of security, observability and networking tools.

Most people will experience eBPF through the tools built on it, such as Cilium, bpftrace, and Tetragon. As well as getting an introduction to these tools and an understanding of how eBPF makes them so powerful, you’ll see eBPF code examples that will give you a mental model for how these complex tools make use of the eBPF platform. This course is designed for professionals who want to get hands-on with a dynamic new technology to get a better understanding of how it works and what its possibilities are.

What you’ll learn and how to apply it

By the end of this course the learner should have a good mental model for what eBPF is, and a conceptual understanding of why eBPF is a great platform for infrastructure tooling. They will be introduced to some of the leading eBPF-based tools in the areas of networking, security and observability. They will have a basic understanding of how eBPF programs are verified and run in the kernel, and how they are able to share data with user space programs.

• Module 1: eBPF Basics

  Describe what eBPF programs and eBPF maps are, experiment with the eBPF version of “Hello World,” and use bpftool to list eBPF programs and maps loaded into the kernel.

• Module 2: eBPF for Networking

  See examples of eBPF programs manipulating network packets; understand that eBPF programs can be attached to various points in the network stack; and meet Cilium, an open source networking project, and see how it uses eBPF for high-performance network connectivity in cloud native environments.

• Module 3: eBPF for Observability

  Describe why eBPF is a great platform for observability tools and recognize several eBPF-based tools and their uses, including: bpftrace, Inspektor Gadget, and Hubble.

• Module 4: eBPF for Security

  Differentiate between security observability and enforcement, explain how different eBPF attachment points have different properties for security tools, see examples of eBPF programs attached to the Linux Security Module API, and describe Cilium Tetragon, an open source security tool for security.

• Module 5: eBPF Machinery

  Describe how eBPF programs and maps are loaded into the kernel, explain how BPF bytecode is executed in the kernel, and talk about some of the reasons why the eBPF verifier might reject a program.

This course is for you because

• You’re a developer, have heard of eBPF and want to get hands-on to get a better understanding.
• You’re a cloud native engineer or developer working in cloud native platforms or infrastructure and want to understand how eBPF-based tools can help.
• This course uses example programs in Python and C - you don’t need an in-depth knowledge of any of these, but you should be comfortable with following along with straightforward code examples.
• You’re an engineer or developer familiar with the Linux command line, for example commands like ps, ls, cat, and want to explore the extensive and powerful possibilities eBPF opens up.

Prerequisites

• Intermediate familiarity with Linux, including shell commands such as ps, ls, and make, and concepts such as processes and their IDs
• Enough programming experience to be comfortable with following along with code examples, and a basic understanding of concepts such as compiled or interpreted programs