The Linux kernel grew a programmable packet datapath. Where the hooks actually sit — XDP at the driver edge, tc/clsact in the stack — what each one can and cannot do, how DDoS scrubbing and L4 load balancing get built on them, and the honest operational cost of running eBPF in the datapath.
Ebpf
-
eBPF for Networking -
BPF Performance Tools Tour: bcc, bpftrace, and libbpf A tour of the eBPF performance tooling that has reshaped Linux observability — bcc, bpftrace, and libbpf — with practical one-liners and scripts for tracing kernel and userspace events at production scale.
-
Cilium as a Full CNI: Beyond Observability Cilium is far more than eBPF observability — a full Kubernetes CNI that replaces kube-proxy, enforces identity-based network policy, peers BGP, meshes services, and load-balances in hardware. How it works and how to run it as your networking layer.
-
Runtime Security with Falco: Syscall-Level Threat Detection for Kubernetes A comprehensive guide to Falco—covering how it works at the kernel level with eBPF, writing custom detection rules, integrating with alerting pipelines, and building a complete runtime security posture for Kubernetes workloads.
-
eBPF for Observability A practical guide to using eBPF for deep observability — tracing system calls and kernel events with bpftrace, profiling applications with BCC tools, and building network visibility with Cilium.
-
Kubernetes Networking Internals: kube-proxy, iptables vs eBPF, CNI Plugins, and DNS A deep dive into how Kubernetes networking actually works — the pod network model, kube-proxy and Service implementation, iptables vs eBPF data planes, CNI plugin comparison, and CoreDNS resolution internals.
-
Network Observability with Cilium and Hubble: Complete Visibility Into Your Kubernetes Network A comprehensive guide to Cilium and Hubble — installing the eBPF-based CNI, capturing flow logs, debugging network policies, building Grafana dashboards, and achieving complete network visibility in Kubernetes.