Tag: #ebpf

← All posts

• Open Source Worth Watching Right Now (4) Observability and Security

  With observability data, volume is cost, and a security tool that never makes it into the pipeline never gets used. This post introduces 12 open source projects that have genuinely taken hold — instrumentation standards,

  2026-08-12 · 5 min read #open-source#observability#security#opentelemetry#ebpf

• The eBPF Verifier Only Tells You Where It Stopped — Measuring the Diagnostic Gap Across 235 Reproduced Rejections

  Anyone who has used eBPF has lived this: the verifier rejects your program, and the error message points at a line that looks perfectly innocent. A paper published in July 2026 is the first to put a number on that frustr

  2026-07-16 · 18 min read #ebpf#linux#kernel#debugging#developer-experience

• eBPF Fundamentals — Programs, Maps, and the World of the Verifier ♪ Listenable

  A ground-up tour of how eBPF changed Linux kernel programming. We cover program types and maps, how the verifier works, and build a first eBPF program with libbpf and CO-RE from scratch.

  2026-06-13 · 19 min read #ebpf#linux#kernel#libbpf#observability

• eBPF Observability in Practice — Opening the Black Box with bpftrace

  Ten battle-tested bpftrace one-liners and a tour of the BCC toolbox for inspecting live systems without touching application code. Covers latency histogram interpretation, flame graphs, container environments, and three

  2026-06-13 · 15 min read #ebpf#bpftrace#observability#linux#profiling

• A Packet Journey — Tracing the Linux Kernel Networking Stack ♪ Listenable

  We dissect the full path a packet takes from the NIC through DMA, ring buffers, NAPI, and the IP/TCP layers to the application socket. Covers RSS/RPS/RFS multi-core scaling, GRO/GSO/TSO offloads, XDP, socket buffer tunin

  2026-06-13 · 19 min read #linux#kernel#networking#tcp#xdp

• eBPF Runtime Security — Tetragon, Falco, and BPF LSM

  Why runtime security is essential in the era of supply chain attacks and container escapes, and how eBPF answers the call. Covers Falco rule writing, kernel-level blocking with Tetragon TracingPolicy, the principles of B

  2026-06-13 · 15 min read #ebpf#security#falco#tetragon#kubernetes

• Cilium Datapath Architecture — Inside a Cluster Without kube-proxy

  A deep dive into the eBPF datapath of Cilium, the CNCF graduated CNI, following a packet on its journey. We cover how kube-proxy replacement works, the identity-based security model, tunneling versus native routing, and

  2026-06-13 · 16 min read #cilium#ebpf#kubernetes#cni#networking

• eBPF Is Eating Observability

  The idea of safely running sandboxed programs inside the kernel is upending observability. Hook anywhere with kprobes, uprobes, tracepoints, and XDP; the verifier guarantees safety; trace without touching a line of appli

  2026-06-11 · 13 min read #ebpf#observability#linux#kernel

• Software Debugging Tools 2026 Deep Dive — gdb, lldb, rr, Pernosco, Replay.io, ASan, Valgrind, eBPF, perf, Time-Travel Debugging ♪ Listenable

  A full map of the 2026 debugging landscape in one read. From the undefeated reign of printf to interactive debugging with gdb/lldb, time-travel and omniscient debugging via rr/Pernosco/Replay.io, the ASan-vs-Valgrind tra

  2026-05-16 · 25 min read #debugging#gdb#lldb#rr#pernosco

• Observability 2026 Complete Guide — OpenTelemetry, Datadog, Grafana Stack (LGTM+Beyla), Honeycomb, Prometheus, Jaeger, eBPF & SLO Deep Dive ♪ Listenable

  A thorough look at the 2026 production observability stack on top of the OpenTelemetry standard. Covers SaaS vendors (Datadog, New Relic, Dynatrace, Splunk, Honeycomb, Coralogix, Logz.io, Chronosphere), open-source stack

  2026-05-16 · 18 min read #observability#opentelemetry#datadog#grafana#honeycomb

• Networking 2026 Complete Guide - Cilium, WireGuard, Tailscale, Nebula, Istio, Envoy, Cloudflare Tunnel Deep Dive

  A complete look at the 2026 production networking stack. eBPF-based K8s networking (Cilium, Calico eBPF, Antrea), overlay VPNs (WireGuard, Tailscale, Nebula, ZeroTier, Twingate, OpenZiti), service meshes (Istio ambient,

  2026-05-16 · 18 min read #networking#cilium#ebpf#wireguard#tailscale

• Network & Service Observability 2026 Deep Dive — eBPF · Cilium Hubble · Pixie · Pyroscope · Grafana Loki + Tempo + Mimir · Netdata · OpenTelemetry ♪ Listenable

  In 2026, observability rests on four pillars (metrics, logs, traces, profiles) and eBPF auto-instrumentation is now the default. Cilium Hubble, Pixie, Pyroscope, the Grafana LGTM stack, Netdata, and OpenTelemetry — a sin

  2026-05-16 · 21 min read #observability#ebpf#cilium-hubble#pixie#pyroscope

• Kubernetes Admission Policies & Security 2026 — Kyverno (CNCF Graduated) / OPA Gatekeeper / VAP (CEL) / Falco / KubeArmor / Tetragon Deep Dive ♪ Listenable

  The full topology of Kubernetes security in 2026. Kyverno that became CNCF Graduated in November 2024, Rego-based OPA Gatekeeper, the built-in Validating Admission Policy that went GA in k8s 1.30 (CEL), the alpha Mutatin

  2026-05-16 · 24 min read #kubernetes#security#admission-controller#kyverno#opa-gatekeeper

• eBPF Observability 2026 — Pixie / Parca / Cilium Hubble / Tetragon / Beyla / Coroot / Falco Deep Dive ♪ Listenable

  A complete map of the eBPF ecosystem as of 2026. Compares Pixie, Parca, Cilium Hubble, Tetragon, BCC/bpftrace, OpenTelemetry eBPF Collector, Grafana Beyla, Coroot, Inspektor Gadget, Kepler and Falco — plus the CO-RE revo

  2026-05-15 · 24 min read #ebpf#observability#pixie#parca#cilium

• A Modern Understanding of the Operating System — io_uring, cgroups/namespaces, eBPF, NUMA, GPU UVM, EEVDF, Zero-Copy Complete Guide (2025)

  iouring as the successor to epoll, the cgroups + namespaces that made Docker, the eBPF that injects code into the kernel safely, the hidden cost NUMA imposes, GPU drivers and UVM, the EEVDF scheduler that landed in Linux

  2026-04-15 · 13 min read #operating-systems#linux#io-uring#cgroups#namespaces

• Service Mesh Deep Dive — Envoy, Istio, Linkerd, Cilium eBPF, Ambient Mesh, xDS/mTLS

  Why sidecar proxies appeared — and why they are being abandoned. Envoy internals, xDS API flow, mTLS handshake, Ambient Meshs Ztunnel, and Ciliums sidecar-less eBPF mesh, all in one place.

  2026-04-15 · 10 min read #service-mesh#envoy#istio#linkerd#cilium

• Observability Complete Guide — Metric, Log, Trace, OpenTelemetry, eBPF, SLO (Season 2 Ep 9, 2025)

  "If you cannot observe it, you cannot operate it." Observability is the superset of logging and monitoring — the ability to infer unknown unknowns from system state alone. This post covers the Metric, Log, Trace three-pi

  2026-04-15 · 11 min read #observability#opentelemetry#prometheus#grafana#loki

• eBPF Deep Dive — The VM, Verifier, XDP, and CO-RE That Made the Linux Kernel Programmable (2025)

  Injecting safe code into the kernel — that is the eBPF revolution. This post dissects eBPF from internals to practice: the VM and bytecode, the Verifier that enforces safety, maps (Hash/Array/Ring Buffer/Perf), program t

  2026-04-15 · 15 min read #ebpf#linux#kernel#xdp#observability

• eBPF Complete Guide — A Tiny VM Inside the Kernel: Verifier, JIT, CO-RE, Maps, Attach Points, XDP, LSM, sched_ext (2025) ♪ Listenable

  Everything about eBPF — from cBPF in 1992 to eBPF in 2014 to schedext in 2024. The 11-register virtual machine ISA, the verifier's static analysis, JIT compilation, BTF and CO-RE, 17+ BPF map types, 200+ helper functions

  2026-04-15 · 31 min read #linux#kernel#ebpf#bpf#xdp

• Linux Performance Engineering Complete Guide 2025: Profiling, System Tuning, eBPF, Bottleneck Analysis ♪ Listenable

  Everything about Linux performance! USE methodology (Utilization/Saturation/Errors), perf/bpftrace/eBPF, Flame Graphs, CPU/memory/disk/network bottleneck analysis, sysctl tuning, cgroups v2, I/O schedulers, NUMA, kernel

  2026-04-14 · 21 min read #linux#performance#profiling#ebpf#perf