Cilium eBPF Demos

This repository contains multiple demos showcasing the usage of eBPF with Cilium for Go applications. Each demo is designed to highlight different aspects of eBPF and its interaction with Go applications, including uProbes, uRetprobes, and function execution time tracking.

Overview

Each folder within this repository contains a specific demo illustrating a unique feature of eBPF and its integration with Go applications. The demos include:

1. Overview
2. Prerequisites
3. How Kernel Space and User Space Interacts in this examples
4. Useful Resources

For more details on each demo, please refer to the README file within the respective demo folder.

Prerequisites

To run these demos, you need a Linux system with the following tools and packages installed:

• Linux Kernel: Version 4.15 or higher with BPF enabled.
• bcc tools: BPF Compiler Collection tools.
• clang and llvm: Required for compiling eBPF programs.
• Go: Version 1.22 or higher.

How Kernel Space and User Space Interacts in this examples

graph TD
    subgraph User Space
        A[Go Application]
        B[Tracing Application]
    end

    subgraph System Call Interface
        C[System Calls]
    end

    subgraph Kernel Space
        D[eBPF Program]
        E[uprobe - Store Start Time in Hash Map]
        F[Hash Map - Start Times]
        G[Ring Buffer - Events]
    end

    A -->|Makes HTTP Request| A2[Go demo Function]
    B -->|Setup uprobe using System Calls| C
    C -->|Load eBPF Program and Setup Probes| D
    D --> E
    E -->|Store Start Time in Hash Map| F
    E -->|Store Result in Ring Buffer| G
    G --> I[Tracing Application Reads Data from Ring Buffer]
    B -->|Read Data from Ring Buffer| I

Loading

Useful Resources

Here are some useful resources to understand eBPF, Go, and their integration:

• Great Medium Article on BPF and Go
• Liz Rice's Talk on eBPF
• Pixie Demo on eBPF
• Cilium eBPF Documentation
• Series of good blog posts
• List of BPF helper functions
• Go opentelemetery instrumentation

License

This project is licensed under the MIT License - see the LICENSE file for details.