eBPF

As explained in Cloud Observability in Action

eBPF is a technology for safely running sandboxed programs in the Linux kernel to observe or extend system behavior.

eBPF is a Linux kernel extension mechanism for running verified, sandboxed programs inside the kernel. It exposes this capability to user space through the bpf(2) system call, allowing user-space functionality to respond to kernel or application events and collect telemetry without modifying application code. section 6.2.2 section 9.1.2 section 4.3.1

eBPF commonly supports observability workflows by:

• Collecting fine-grained metrics, traces, profiles, and other telemetry without manual instrumentation or service redeploys. section 6.2.2
• Automating profile collection from application code or the operating system for continuous profiling and flame-graph analysis. section 9.1.2 section 9.4
• Extending Linux safely while retaining operational constraints: kernel support, debug symbols, provider policies, and production performance considerations still matter. section 9.1.2 section 4.3.1

Kubernetes debugging with Pixie

Pixie uses eBPF to collect real-time Kubernetes telemetry, including fine-grained request data, without code changes or redeploys. Users query the in-memory data with PxL and can export telemetry to an OpenTelemetry-compatible endpoint for longer-term retention; Pixie itself does not provide historical storage by design. section 6.2.2

Figure 9.3 The eBPF call flow in the Linux kernel at a conceptual level (Source: Brendan Gregg. Licensed under CC BY 4.0)

Use the conceptual call-flow figure to relate event-triggered eBPF programs to kernel-level profile collection. section 9.1.2

How Cloud Observability in Action covers it

How deep it goes

Explains verified kernel execution, user-space access, event triggering, and observability uses, but does not detail program construction.

Examples

Uses Pixie debugging, operating-system profiles, flame graphs, and Go auto-instrumentation as concrete applications.

What it assumes

Assumes Linux and observability familiarity while requiring compatible kernel versions, debug symbols, and platform-team approval for production use.

What you can do after

Apply it via observability tools to collect profiles and telemetry without application changes, subject to platform compatibility.

How it connects

Connects eBPF with Linux kernels, continuous profiling, flame graphs, auto-instrumentation, OpenTelemetry, and Pixie.

liveBookmanning.com

Read Cloud Observability in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Cyber Threat HuntingeBPF is a Linux kernel technology that safely runs sandboxed programs in response to kernel and networking events for observability, tracing, and security enforcement.

Compare how 2 books explain eBPF →

Related concepts

• Falcoused by · Falco is an open-source cloud-native runtime security tool that monitors system activity to detect suspicious or anomalous behavior in hosts, containers, and Kubernetes environments.
• Dataplane v2used by · Dataplane V2 is a GKE networking dataplane architecture based on eBPF and Cilium for implementing pod networking and network policy.
• Linuxuses · Linux is an open-source operating-system kernel and the family of Unix-like operating systems built around it.
• Pixieused by · Pixie is a Kubernetes-specific, real-time debugging platform that collects and analyzes telemetry without requiring manual instrumentation or application redeploys.

This explainer was generated by Manning's knowledge graph from the text of Cloud Observability in Action. The section links point to the parts of the book it draws on.