{"id":15003635,"url":"https://github.com/thejokr/ebpf-playground","last_synced_at":"2026-02-09T08:35:24.887Z","repository":{"id":226490062,"uuid":"759480370","full_name":"TheJokr/ebpf-playground","owner":"TheJokr","description":"Collection of small eBPF code examples","archived":false,"fork":false,"pushed_at":"2024-03-08T07:29:42.000Z","size":33,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-07T09:56:59.805Z","etag":null,"topics":["ebpf","golang-examples","linux-kernel","observability"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/TheJokr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-18T17:53:23.000Z","updated_at":"2024-06-20T20:13:41.000Z","dependencies_parsed_at":"2024-09-28T15:00:31.164Z","dependency_job_id":null,"html_url":"https://github.com/TheJokr/ebpf-playground","commit_stats":null,"previous_names":["thejokr/ebpf-playground"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/TheJokr/ebpf-playground","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheJokr%2Febpf-playground","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheJokr%2Febpf-playground/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheJokr%2Febpf-playground/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheJokr%2Febpf-playground/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/TheJokr","download_url":"https://codeload.github.com/TheJokr/ebpf-playground/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheJokr%2Febpf-playground/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":272236585,"owners_count":24897452,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-26T02:00:07.904Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","golang-examples","linux-kernel","observability"],"created_at":"2024-09-24T18:59:35.430Z","updated_at":"2026-02-09T08:35:24.859Z","avatar_url":"https://github.com/TheJokr.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ebpf-playground\n[![Go version](https://img.shields.io/badge/v1.21-555?logo=go)](go.mod)\n[![License](https://img.shields.io/badge/license-MIT-informational)](#license)\n\nThis repository serves to collect eBPF programs and supporting code that I build\nto explore, demonstrate, test, and evaluate various features of eBPF in the Linux kernel.\nI aim to extensively document my eBPF programs, such that they may also be helpful as\nintroductions and guides to the landscape of low-level eBPF programming.\n\nThe first tool, `observer`, is a tracer for HTTP client requests from Go's `net/http`\nstdlib package. It attaches to any (non-stripped) Go binary, *without requiring separate\ninstrumentation code inside the binary*. The idea originates from distributed tracing\nprovider [Odigos], and also sits at the core of Grafana Labs' [Beyla] toolchain. Check out\n[`probe.c`](observer/bpf/probe.c) to take a look behind the magic.\n\n[Odigos]: https://news.ycombinator.com/item?id=34442603\n[Beyla]: https://grafana.com/blog/2023/09/13/grafana-beyla-open-source-ebpf-auto-instrumentation/\n\n## Usage\nSince compiled eBPF objects are checked into the repository, building any of the applications\nrequires just a Linux host with an up-to-date Go toolchain (v1.21+) and the ability to set\n[file capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html). If you can\n`sudo`, you are probably all set. For ease-of-use there is also a devcontainer setup included\nin this repo, which fulfills all requirements.\n\nThe Makefile contains all necessary commands for an `observer` demonstration:\n```shell\n# By default, the Makefile builds the observer tool. File capabilities are set\n# as part of the build, which uses sudo and thus might ask for your password.\n# The tool is built under /tmp to ensure filesystem support for capabilities.\n$ make\n# This next commands starts a fake service mesh based on nicholasjackson/fake-service\n# to give observer something to attach to.\n$ make run-mesh\n# Finally, in a separate shell, we can start the observer. This simply executes\n# /tmp/observer /path/to/fake-service. You can attach to any Go app by exchanging\n# the path argument (provided you didn't strip its symbol table).\n$ make observe-mesh\n# When you open http://localhost:8080/ with your browser, curl, or some other HTTP client,\n# you will see all the background requests in the service mesh logged by the observer.\n```\n\n### Compiling eBPF Programs\nIf you want to hack on an eBPF program, you will need a C-to-eBPF toolchain in addition\nto the requirements listed above. clang/LLVM is most commonly used for this task, but a\nfew additional dependencies are also required. I recommend either using the included\ndevcontainer directly, or checking out its [Dockerfile](.devcontainer/Dockerfile).\n\n## License\nAll code in this repository is licensed under the [MIT license](LICENSE) and may freely\nbe copied and re-used in accordance with that license. eBPF code and related header files\n(everything below a `bpf/` subdirectory) is additionally licensed under the\n[GNU GPLv2](https://www.gnu.org/licenses/gpl-2.0.html) at your option.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthejokr%2Febpf-playground","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthejokr%2Febpf-playground","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthejokr%2Febpf-playground/lists"}