eBPF Manager

This repository implements a manager on top of Cilium's eBPF library. This declarative manager simplifies attaching and detaching eBPF programs by controlling their entire life cycle. It was built with the intention of unifying how eBPF is used in large scale projects such as the Datadog Agent. By using the same declarative conventions, multiple teams can quickly collaborate on complex eBPF programs by sharing maps, programs or even hook points without having to worry about the setup of complex program types.

Requirements

• A version of Go that is supported by upstream
• Linux 4.4+ (some eBPF features are only available on newer kernel versions, see eBPF features by Linux version)

Getting started

You can find many examples using the manager in examples/. For a real world use case, check out the Datadog Agent.

Useful resources

• Cilium eBPF library
• Cilium eBPF documentation
• Linux documentation on BPF
• eBPF features by Linux version

License

• Unless explicitly specified otherwise, the golang code in this repository is under the MIT License.
• The eBPF programs are under the GPL v2 License.