Learning eBPF: Programming the Linux Kernel for Enhanced Observability, Networking, and Security

What is eBPF? With this revolutionary technology, you can write custom code that dynamically changes the way the kernel behaves. It's an extraordinary platform for building a whole new generation of security, observability, and networking tools.

This practical book is ideal for developers, system administrators, operators, and students who are curious about eBPF and want to know how it works. Author Liz Rice, chief open source officer with cloud native networking and security specialists Isovalent, also provides a foundation for those who want to explore writing eBPF programs themselves.

With this book, you will:

• Learn why eBPF has become so important in the past couple of years
• Write basic eBPF code, and manipulate eBPF programs and attach them to events
• Explore how eBPF components interact with Linux to dynamically change the operating system's behavior
• Learn how tools based on eBPF can instrument applications without changes to the apps or their configuration
• Discover how this technology enables new tools for observability, security, and networking

Liz Rice is the chief open source officer with eBPF specialists at Isovalent, creators of the Cilium cloud native networking, security and observability project. She sits on the CNCF Governing Board and on the Board of OpenUK. She was chair of the CNCF's Technical Oversight Committee in 2019-2022, and co-chair of KubeCon + CloudNativeCon in 2018. She is also the author of Container Security published by O'Reilly.
She has a wealth of software development, team, and product management experience from working on network protocols and distributed systems and in digital technology sectors such as VOD, music, and VoIP. When not writing code, or talking about it, Liz loves riding bikes in places with better weather than her native London, competing in virtual races on Zwift, and making music under the pseudonym Insider Nine.