eBPF

ELI5 - The Vibe Check

eBPF lets you drop small, safe programs straight into the Linux kernel while it's running, so you can watch every network connection, file open, or system call happening on a machine without slowing anything down or rebooting. It's like installing cameras directly into a building's wiring instead of bolting them onto the walls afterward: you see everything, and nothing has to be torn apart to fit them.

Real Talk

eBPF (extended Berkeley Packet Filter) lets sandboxed programs run inside the Linux kernel to observe or intercept system calls, network packets, and process events with minimal overhead. It underpins modern runtime security and observability tools, such as Falco and Cilium, that detect malicious behavior at the kernel level instead of relying on agents in userspace.

Show Me The Code

- rule: Shell spawned in container
  desc: Detect a shell being spawned inside a running container
  condition: spawned_process and container and proc.name in (bash, sh, zsh)
  output: "Shell spawned (container=%container.name command=%proc.cmdline)"
  priority: WARNING

When You'll Hear This

"Falco's eBPF probe caught the container trying to spawn a shell." / "We moved network policy enforcement to eBPF with Cilium instead of iptables."