Learning eBPF

A book on eBPF technology, built on the famous packet filter invented at the University of Berkeley (Berkeley Packet Filter), allowing user packets to pass into the Linux kernel and thus modify the behavior and functions of the kernel. The book discusses how eBPF relates to the structure of the Linux kernel and its extensions, which system calls are used when servicing eBPF, and the role eBPF plays in ensuring security. It covers programming modules for eBPF and explains practical aspects of using this mechanism: porting programs from distribution to distribution and from corporate servers to the cloud.