~10,000 readers a month · the main event

The blog

Long-form notes on platform engineering, cloud-native infrastructure, the Linux kernel and the messy reality of running AI workloads. Written in the open, occasionally opinionated.

More writing

18 September 2025 · 11 min read

A Tour of eBPF in the Linux Kernel: Observability, Security and Networking

eBPF lets you run small, verified programs inside the Linux kernel, enabling fast observability, security, and networking without changing application code. This practical tour explains why eBPF matters now, how programs are compiled, verified, JITed, and attached to events, and how maps and ring-3 buffers move data. You'll leave with simple demos and a clear mental model to start experimenting.

ebpflinuxobservabilitysecuritynetworking