http://blog.ghanmi.me/categories/engineering/Recent content in Engineering on MLogHugo -- gohugo.ioen-usTue, 24 Mar 2026 01:38:01 +0100http://blog.ghanmi.me/posts/building-an-ebpf-tracing-tool/Mon, 12 Aug 2024 00:00:00 +0000http://blog.ghanmi.me/posts/building-an-ebpf-tracing-tool/What Is eBPF, and Why Should You Care? eBPF (extended Berkeley Packet Filter) started life as a packet filtering mechanism, but it has evolved into a general-purpose in-kernel virtual machine. The key properties that make it so powerful: Safety. eBPF programs are verified before they run. The kernel’s built-in verifier performs static analysis to guarantee your program terminates, doesn’t access out-of-bounds memory, and doesn’t crash the kernel. You get kernel-level access with userspace-level safety guarantees.