• Kernel side
  • either in C or Rust
• userland (more programming languages)
• applications loaded directly into the kernel
• more secure than kernel modules since there is a verifier which does basic checks against the eBPF bytecode
• also Docker uses eBPF technologies under the hood

Resources

• 2023-09-06 ◦ eBPF Offensive Capabilities - Get Ready for Next-gen Malware – Sysdig
• 2022-09-13 ◦ The power of eBPF |> Changelog
• 2022-09-13 ◦ eBPF - Introduction, Tutorials & Community Resources