Skip to main content

Learn Learning paths Courses

The Linux Kernel and eBPF

Observe the kernel, then load your own eBPF programs

고급 · Lessons 29 · Lab 9

Curriculum

The Boundary Between Userspace and the Kernel

The Rules for Sharing a CPU

The Page Cache and OOM

A Box Built from Namespaces and cgroups

There Is No Kernel Object Called a Container reading
Build a Container Without Docker lab
Quiz: Namespaces and cgroups quiz

Instruments the Kernel Already Has

bpftrace One-Liners

Count Where the Event Happens reading
Answer Operations Questions with One-Line eBPF lab
Quiz: bpftrace One-Liners quiz

Load, Attach, Verify

The Verifier Walks Every Branch reading
Read Line by Line Why the Verifier Said No lab
Quiz: Load, Attach, Verify quiz

libbpf and CO-RE

Record the Field's Name, Not Its Offset reading
Compile Once, Run on Any Kernel lab
Quiz: libbpf and CO-RE quiz

XDP and tc

Before a Packet Becomes a Socket Buffer reading
Count and Drop Packets in Front of the Driver lab
Quiz: XDP and tc quiz

BPF That Blocks: seccomp and BPF LSM

BPF That Watches and BPF That Blocks reading
Quiz: seccomp and BPF LSM quiz

Reference docs