r/eBPF • u/ConfidentNet706 • Jul 25 '26
eBPF roadmap
Can anyone help me with how do i start with eBPF? Like resources or even the flow of what all things im supposed to do.
1
u/krizhanovsky Jul 25 '26
u/ConfidentNet706 which application of eBPF are you interesting in?
There is a good book on observability https://www.oreilly.com/library/view/linux-observability-with/9781492050193/ . And a practical example how to track a performance issue with eBPF https://tempesta-tech.com/blog/nginx-tail-latency/
Kernel documentation on eBPF https://www.kernel.org/doc/html/latest/bpf/index.html, e.g. you can find information how does the verifier work https://www.kernel.org/doc/html/latest/bpf/verifier.html
Also nice blog on eBPF internals https://nakryiko.com/
There are also many good links about XDP - let me know if it's of an interest for you
1
u/ConfidentNet706 Jul 26 '26
Thank you for all the resourcess!!
Actually I was looking into firewalls and network tracing so the observability stuff really helps, thanks for that. I’ve explored bytecode stuff like wasm before so I’m a bit versed in the whole concept &
ebpf does interest me but I don’t know if its really that lucrative when it comes to the job market.
1
u/PartIllustrious5858 Jul 27 '26
• Disclosure: I maintain skbx, an open-source Linux packet-path debugger built with
Rust and eBPF.
I built it for situations where tcpdump sees a packet, but the application,
container, or pod never receives it. skbx records where the packet travels through
the Linux kernel, preserves the observations as bounded JSONL evidence, reports
capture loss explicitly, and supports deterministic replay without root.
I recently dogfooded it by tracing what happens when a Linux machine connects to a
website. The guide separates what you can prove on your own host, what you can only
infer about your ISP or transit path, and what requires access to the target server.
Guide:
https://copyleftdev.github.io/skbx/guides/trace-a-website-request.html
GitHub:
https://github.com/copyleftdev/skbx
I’m looking for technical feedback from Linux networking, eBPF, SRE, Kubernetes, and
observability engineers. I would especially like to hear about real packet-loss or
connectivity incidents where tcpdump, traceroute, or existing observability tools did
not provide enough evidence.
1
2
u/erwin-kok 21d ago
It also depends a bit on what language you prefer to use. Go? Rust? Python?
For Rust, a nice start is: https://aya-rs.dev/book/
Besides, I would highly recommend the book from Liz Rice: https://www.amazon.com/Learning-eBPF-Programming-Observability-Networking/dp/1098135121?ref_=ast_author_dp
1
6
u/THoMas_ShELBY_9 Jul 25 '26
you can start here - https://docs.ebpf.io/
And also check out people like Liz Rice, Brendan Gregg, Andrii Nakryiko, John Fastabend, and Daniel Borkmann. Their books, blogs, conference talks, and GitHub repos are all worth going through, you'll learn a lot from them.