https://vmlinuz.pl/en/tags/bpftrace/ Recent content in Bpftrace on vmlinuz Hugo en 2025-2026 vmlinuz.pl Sat, 13 Jun 2026 10:00:00 +0100 https://vmlinuz.pl/en/posts/ebpf/ Sat, 13 Jun 2026 10:00:00 +0100 https://vmlinuz.pl/en/posts/ebpf/ <p><a href="https://vmlinuz.pl/en/posts/kprobes/">Kprobes</a> let you inject code anywhere in the kernel, but you do it by writing a kernel module. One bug and you get a kernel panic. eBPF solves that: you load a small program into the kernel, and a verifier guarantees it can&rsquo;t do anything dangerous. It&rsquo;s now the foundation of modern observability, networking and security on Linux.</p> <h2 id="what-is-ebpf">What is eBPF?</h2> <p>eBPF (extended Berkeley Packet Filter) is a virtual machine inside the kernel. It runs small programs in kernel space, attached to events, without recompiling the kernel and without rebooting. Roughly, it works like this:</p>