#ebpf

Corootcoroot
2025-12-11

☁️ 🐘 Learn how to manage complex cloud environments with Co-Founder Peter Zaitsev’s keynote at @p2d2! p2d2.cz/en/

Join January 28th, 15:35–16:25 (GMT+1) to sharpen your cloud-native observability with topics such as and automatic discovery mechanisms for High Availability postgres clusters.

2025-12-09

As it is my last week at Cisco Isovalent, glad to see early experiments of kernel CVEs/Exploits protections (patching) using #eBPF becoming real Products: Tetragon CVEs Mitigations and Cisco Live Protect! thanks to all Tetragon team!

isovalent.com/blog/post/isoval

:rocinante:DomCyrus
2025-12-07

RustNet v0.17.0 released 🎉

What's New:
- Landlock sandbox & capability dropping (Linux security)
- eBPF thread-to-process name resolution
- New CLI options: --no-sandbox, --sandbox-strict
- Platform code reorganization

Installation:
Fedora/RHEL: COPR | Ubuntu: PPA | Arch: AUR
macOS: Homebrew | Windows: Chocolatey | FreeBSD: pkg

🔗 github.com/domcyrus/rustnet/re

2025-12-02

Мониторинг в Linux на уровне ядра. Краткое практическое введение в eBPF+Cilium

Добрый день, всем читающим данную статью. Недавно эксперементируя с eBPF для разработки нового функционала своей EDR для linux-серверов , я столкнулся с огромной проблемой: на просторах интернета есть огромный пласт статей по теории работы с eBPF, однако кратких практических статей как работать с BPF мной найдено не было. Если быть более точным, то такие статьи есть, однако, они не дают понимания функционала. В общем, в данной статье хотелось бы написать краткий гайд по работе с eBPF с уклоном в практику

habr.com/ru/articles/972602/

#eBPF #bpf #go #edr #разработка #мониторинг #трассировка #ядро #ядро_linux #linux

2025-12-02

Kprobes и где они обитают

Про eBPF уже сказано и написано достаточно много, поэтому я хочу сделать следующий шаг и чуть глубже рассмотреть практические аспекты работы c таким механизмом, как kprobe , который позволяет использовать функции ядра Linux для динамического запуска пользовательского кода. Статья поможет ответить на вопросы: - Как понять, какую функцию ядра выбрать для использования с механизмом kprobe? - С чего начать ее поиск? - Какими инструментами пользоваться? kprobe — это, по сути, ловушка, или брейкпоинт, который можно установить почти в любом месте кода ядра Linux.

habr.com/ru/companies/pt/artic

#ebpf #kprobes #linux #linux_kernel #container_security #контейнеризация #tetragon #ftrace #bpftrace #open_source

2025-12-02

This is what I did for the
eBPF Summit: Hackathon Edition 2025

Caetra uses eBPF (extended Berkeley Packet Filters) to try secure a Linux machine against physical threats, or at least be aware about a potential attack, monitoring kernel kprobes related with hardware interactions. It uses BPF Compiler Collection BCC to do the kernel tracing and manipulation program.

In order to notify the user or cybersecurity team uses @ThinkstCanary and/or TelegramBot.

devpost.com/software/caetra

#eBPF #bcc

Quentin Monnetqeole@hachyderm.io
2025-12-01

December again. Christmas is getting near, winter is coming*, and... The call for proposals for the eBPF Devroom at FOSDEM'26 is about to close. Today is your last chance to submit! If you have things to say about eBPF, send an abstract ⚙️ 🐝

ebpf.io/fosdem-2026.html

* Subject to availability in your hemisphere

#fosdem #fosdem2026 #eBPF

2025-11-29

Yesterday I discovered #eBPF while searching for a way to more directly monitor #Linux processes.

It let's you write sandboxed programs that are ran directly by a runtime in the kernel, with all of the power that entails.

I spent ~22 hours straight tinkering with it, it is fascinating, the documentation is a bit obtuse but the API isn't that hard to use.

I won't use it for anything right now but I want to think of some little project to test it in the near future.

#programming

:radare2: radare :verified:radareorg@infosec.exchange
2025-11-28

☀️The deeply detailed talk from ulexec and secoalba from @inversive_xyz about reverse engineering #Solana #eBPF binaries with #radare2 was built on top of several improvements for the elf bin parser and the architecture support for the 64bit #BPF.

All that stuff was also included in the last r2-6.0.6 release:

- esil emulation of bytecode
- pseudo decompilation
- AI-based disassembly
- bpf-specific elf relocs
- bpf-specific analysis plugin to extract strings
- document every bpf instruction
- support multiple "cpu" models
- binary patching and assembling BPF instructions

Cook some popcorns and take notes because their presentation was really detailed! Worth watching!
🎥 youtube.com/watch?v=IAt-HgKPN88

Corootcoroot
2025-11-26

✂️ ☁️ Gartner estimates companies overspend on cloud services by up to 70%. Sound about right? Learn how to use the tool to gain an in-depth understanding of your bill and cut costs: coroot.com/blog/how-to-reduce-

Get visibility into per-application costs, idle and underutilized resources, over-provisioned apps, and cross-AZ and egress traffic.

Quentin Monnetqeole@hachyderm.io
2025-11-26

Did you know that you can call helper function bpf_for_each_map_elem() in eBPF programs to run a callback function on all elements in a map?

... If you did, please consider submitting a talk about your eBPF-related work to the FOSDEM Devroom! Send your abstract by Monday, 1st December ⚙️ 🐝
ebpf.io/fosdem-2026.html

#fosdem #fosdem2026 #eBPF

2025-11-26

Tetragon: лучшие практики и нюансы разработки Tracing Policy

Привет! Меня зовут Виталий Шишкин, я эксперт продукта Container Security в Positive Technologies. За годы работы над продуктом MaxPatrol 10 мы строили аудит Linux на базе подсистемы Auditd, которая решала свою задачу и достаточно просто настраивалась, но ситуация поменялась с появлением контейнеров, которые Auditd корректно поддерживать не умеет. Поэтому эта задача потребовала не просто смену решения для аудита системы, но и создание целого продукта, который сможет учитывать особенности Kubernetes и используемые им технологии ядра Linux.

habr.com/ru/companies/pt/artic

#tetragon #linux #cloud_native #информационная_безопасность #аудит_безопасности #kubernetes #auditd #kprobes #ebpf

Corootcoroot
2025-11-25

bootcamps, workshops, and 40+ keynotes from industry experts. Join the international community of enthusiasts at , Dec. 2nd, in Germany and streaming online: devopscon.io/munich/

Kris Buytaert is a long-time evangelist and DevOps expert. Catch his talk to learn what sets apart from other open observability tools and how to deploy it your ecosystem!

The Linux Foundationlinuxfoundation@social.lfx.dev
2025-11-25

🔭 Modern systems demand real-time insight and resilience — and eBPF has become essential for today’s DevOps and cloud teams.

In “eBPF Essentials: Security and Observability (LFWS304),” a 1-day instructor-led workshop, you’ll deploy eBPF programs, build observability pipelines, and enforce runtime security in Kubernetes.

Finish the day with practical, verifiable skills — and a badge to prove it.

🔗 Enroll today: training.linuxfoundation.org/t

#CloudNative #Linux #Security #DevOps #eBPF

2025-11-23

eBPF là một engine thực thi trong kernel Linux, cho phép chạy các chương trình an toàn và hiệu quả. Nó tương tự như việc đưa JavaScript vào kernel, mở ra khả năng quan sát và theo dõi hệ thống sâu hơn. Bài viết này giải thích về eBPF và ứng dụng của nó trong observability.

#eBPF #observability #linux #programming #tech #côngnghệ #lậptrình #linuxkernel

reddit.com/r/programming/comme

Quentin Monnetqeole@hachyderm.io
2025-11-20

RE: hachyderm.io/@qeole/1154628894

eBPF Devroom at FOSDEM 2026: Submission is open until 1st December. Please remember to send your abstracts!
#fosdem #fosdem2026 #eBPF

Stéphane Bortzmeyerbortzmeyer@mastodon.gougere.fr
2025-11-20

Compte-rendu, et mise en œuvre complète, de l'atelier #eBPF au #CapitoleDuLibre, un bloqueur de pub #DNS en eBPF bortzmeyer.org/ebpf-capitole-l

Stéphane Bortzmeyerbortzmeyer@mastodon.gougere.fr
2025-11-19

Et le bilan complet, une fois le programme terminé : bortzmeyer.org/ebpf-capitole-l

#eBPF

Corootcoroot
2025-11-18

Want an-all stack? No problem. GlassFlow v2.4 is here with pipeline editing, kerberos-secured clusters, and significantly optimized ingestion performance: github.com/glassflow

Pair with for out-of-the-box observability with AI-powered root cause analysis. Now with multi-cluster support: github.com/coroot/coroot

The future is 🐧💚 🪲🐝

Client Info

Server: https://mastodon.social
Version: 2025.07
Repository: https://github.com/cyevgeniy/lmst