eBPF Userspace API¶

eBPF is a kernel mechanism to provide a sandboxed runtime environment in theLinux kernel for runtime extension and instrumentation without changing kernelsource code or loading kernel modules. eBPF programs can be attached to variouskernel subsystems, including networking, tracing and Linux security modules(LSM).

For internal kernel documentation on eBPF, seeBPF Documentation.