Using eBPF
Berkeley Packet Filter (BPF) is a technology that was first introduced in 1992 to capture, filter, and analyze network traffic. In 2013, Alexi Starovoitov undertook a rewrite of BPF with help from Daniel Borkmann. Their work, then known as eBPF (extended BPF), was merged into the kernel in 2014, where it has been available since Linux 3.15. eBPF provides a sandboxed execution environment for running programs inside the Linux kernel. eBPF programs are written in C and are just-in-time (JIT) compiled to native code. Before that happens, the intermediate eBPF bytecode must first pass through a series of safety checks so that a program cannot crash the kernel.
Despite its networking origins, eBPF is now a general-purpose virtual machine running inside the Linux kernel. By making it easy to run small programs on specific kernel and application events, eBPF has quickly emerged as the most powerful tracer for Linux. Like what cgroups did for containerized deployments, eBPF...
