eBPF programs run in a sandboxed VM in the kernel. Verified by kernel verifier before loading — cannot crash the kernel or access arbitrary memory. Types: tracepoints, kprobes, uprobes, XDP (network), socket filters. Tools: bpftrace (tracing), Cilium (networking), Falco (security), Pixie (observability).
Additional Reference
This topic has detailed content in adjacent sections. Check Overview for architecture, Fundamentals for core concepts, and Cheatsheets for quick command reference. Cross-reference with related topics in the same academy for complete understanding.
Key Takeaways
•Understand the core architecture and design decisions
•Practice the commands and configurations hands-on
•Review interview questions before any technical interview
•Keep cheatsheets bookmarked for quick reference during work
•Connect this knowledge to adjacent tools in the same domain