{"slug": "ebpf", "name": "eBPF", "category": "infra", "category_name": "Infrastructure and DevOps", "description": "", "recommenders": 4, "commenters": 6, "warners": 0, "score": 3.839, "rising": -1.31, "first": "2025-11-05", "latest": "2026-07-11", "why": "eBPF is a revolutionary technology for the Linux kernel that makes the kernel both secure and programmable.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 1, "compare": 2, "warn": 0}, "spark": [1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "eBPF is a revolutionary technology for the Linux kernel that makes the kernel both secure and programmable.", "kind": "", "icon": true, "domain": "kernel.org", "github_repo": null, "official_url": "https://ebpf.io", "pricing": "", "aliases": ["eBPF"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 781946849, "item_id": 48871678, "url": "https://news.ycombinator.com/item?id=48871678", "by": "skaiuijing", "date": "2026-07-11", "version": null, "stance": "recommend", "quote": "eBPF is a revolutionary technology for the Linux kernel that makes the kernel both secure and programmable.", "excerpt": "Everyone, eBPF is a revolutionary technology for the Linux kernel that makes the kernel both secure and programmable. I\u2019ve been exploring how to bring similar capabilities to microcontrollers with only tens of kilobytes of memory, so I created ccBPF. It is a programming language based on a C-like subset and includes a BPF virtual machine. I have already developed several demonstrations running on both Linux and the S", "context": "", "use_case": "Linux kernel programmability", "switched_from": "", "story": null}, {"id": 752205776, "item_id": 47012861, "url": "https://news.ycombinator.com/item?id=47012861", "by": "ranger_danger", "date": "2026-02-14", "version": null, "stance": "recommend", "quote": "eBPF will", "excerpt": "eBPF will: https://eunomia.dev/tutorials/40-mysql/", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: SQL-tap \u2013 Real-time SQL traffic viewer for PostgreSQL and MySQL"}, {"id": 746811728, "item_id": 46675733, "url": "https://news.ycombinator.com/item?id=46675733", "by": "fc417fc802", "date": "2026-01-18", "version": null, "stance": "recommend", "quote": "Just hook the relevant system call and be done with it.", "excerpt": "You can hook the system call to open a file regardless of libc use. If for some strange reason you really wanted to patch libc and the program you're using statically links it (ex musl) that isn't an issue - just patch the relevant libc implementation and recompile. But more generally, if you have access to the source code then why would you not directly patch the program in question instead of resorting to these sor", "context": "", "use_case": "", "switched_from": "", "story": "A free and open-source rootkit for Linux"}, {"id": 733198752, "item_id": 45824922, "url": "https://news.ycombinator.com/item?id=45824922", "by": "cptnntsoobv", "date": "2025-11-05", "version": null, "stance": "recommend", "quote": "XDP, and the eBPF ecosystem in general, is quite neat.", "excerpt": "XDP, and the eBPF ecosystem in general, is quite neat. However, a word of caution: * The BPF verifier's DX is not great yet. If it finds problems with your BPF code it will spit our a rather inscrutable set of error messages that often requires a good understanding of the verifier internals (e.g the register nomenclature) to debug * For the same source code, the code generated by the verifier can change across compil", "context": "", "use_case": "", "switched_from": "", "story": "An eBPF loophole: Using XDP for egress traffic"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["linux kernel programmability", "kernel-side programs", "web application firewall"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48871677", "title": "item 48871677", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48225338", "title": "Show HN: Write your BPF programs in Go, not C", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47457042", "title": "item 47457042", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47011567", "title": "Show HN: SQL-tap \u2013 Real-time SQL traffic viewer for PostgreSQL and MySQL", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46666288", "title": "A free and open-source rootkit for Linux", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46361927", "title": "Rex is a safe kernel extension framework that allows Rust in the place of eBPF", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {"neutral": 1}, "2026-01": {"recommend": 1}, "2026-02": {"recommend": 1}, "2026-03": {"compare": 1}, "2026-04": {}, "2026-05": {"compare": 1}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 781946849, "item_id": 48871678, "url": "https://news.ycombinator.com/item?id=48871678", "by": "skaiuijing", "date": "2026-07-11", "version": null, "stance": "recommend", "quote": "eBPF is a revolutionary technology for the Linux kernel that makes the kernel both secure and programmable.", "excerpt": "Everyone, eBPF is a revolutionary technology for the Linux kernel that makes the kernel both secure and programmable. I\u2019ve been exploring how to bring similar capabilities to microcontrollers with only tens of kilobytes of memory, so I created ccBPF. It is a programming language based on a C-like subset and includes a BPF virtual machine. I have already developed several demonstrations running on both Linux and the S", "context": "", "use_case": "Linux kernel programmability", "switched_from": "", "story": null}, {"id": 772521248, "item_id": 48282578, "url": "https://news.ycombinator.com/item?id=48282578", "by": "danudey", "date": "2026-05-26", "version": null, "stance": "compare", "quote": "eBPF has a lot more checks in the verifier", "excerpt": "eBPF has a lot more checks in the verifier, which you could read about here if you're interested in learning more: https://docs.kernel.org/bpf/verifier.html Since you don't want to handle any kind of crash, out of bounds exception, etc., the eBPF verifier does a ton of impressively paranoid stuff. It ensures that the program doesn't loop (or if it loops that the loop is provably bounded and cannot be infinite), it gu", "context": "", "use_case": "Kernel-side programs", "switched_from": "", "story": "Show HN: Write your BPF programs in Go, not C"}, {"id": 759312689, "item_id": 47457043, "url": "https://news.ycombinator.com/item?id=47457043", "by": "skaiuijing", "date": "2026-03-20", "version": null, "stance": "compare", "quote": "similar in spirit to eBPF, but built specifically for embedded environments", "excerpt": "I\u2019m building ccbpf to bring eBPF\u2011style programmability to embedded systems. ccbpf includes: - a C\u2011subset compiler (ccbpf\u2011cc) that generates ccbpf bytecode - a small, portable VM for MCUs - a simple map system and hook/event model - a loadable program format designed for constrained devices The goal is to let MCUs load and run small, safe, sandboxed programs\u2014similar in spirit to eBPF, but built specifically for embedd", "context": "", "use_case": "", "switched_from": "", "story": null}, {"id": 752205776, "item_id": 47012861, "url": "https://news.ycombinator.com/item?id=47012861", "by": "ranger_danger", "date": "2026-02-14", "version": null, "stance": "recommend", "quote": "eBPF will", "excerpt": "eBPF will: https://eunomia.dev/tutorials/40-mysql/", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: SQL-tap \u2013 Real-time SQL traffic viewer for PostgreSQL and MySQL"}, {"id": 746811728, "item_id": 46675733, "url": "https://news.ycombinator.com/item?id=46675733", "by": "fc417fc802", "date": "2026-01-18", "version": null, "stance": "recommend", "quote": "Just hook the relevant system call and be done with it.", "excerpt": "You can hook the system call to open a file regardless of libc use. If for some strange reason you really wanted to patch libc and the program you're using statically links it (ex musl) that isn't an issue - just patch the relevant libc implementation and recompile. But more generally, if you have access to the source code then why would you not directly patch the program in question instead of resorting to these sor", "context": "", "use_case": "", "switched_from": "", "story": "A free and open-source rootkit for Linux"}, {"id": 742593712, "item_id": 46412107, "url": "https://news.ycombinator.com/item?id=46412107", "by": "westurner", "date": "2025-12-28", "version": null, "stance": "neutral", "quote": "So eBPF for a WAF isn't worth it?", "excerpt": "So eBPF for a WAF isn't worth it? re: eBPF and WAFs: https://news.ycombinator.com/item?id=45951011 From https://news.ycombinator.com/context?id=43564972 : > Should a microkernel implement eBPF and WASM, or, for the same reasons that justify a microkernel should eBPF and most other things be confined or relegated or segregated in userspace; in terms of microkernel goals like separation of concerns and least privilege ", "context": "", "use_case": "Web application firewall", "switched_from": "", "story": "Rex is a safe kernel extension framework that allows Rust in the place of eBPF"}, {"id": 733198752, "item_id": 45824922, "url": "https://news.ycombinator.com/item?id=45824922", "by": "cptnntsoobv", "date": "2025-11-05", "version": null, "stance": "recommend", "quote": "XDP, and the eBPF ecosystem in general, is quite neat.", "excerpt": "XDP, and the eBPF ecosystem in general, is quite neat. However, a word of caution: * The BPF verifier's DX is not great yet. If it finds problems with your BPF code it will spit our a rather inscrutable set of error messages that often requires a good understanding of the verifier internals (e.g the register nomenclature) to debug * For the same source code, the code generated by the verifier can change across compil", "context": "", "use_case": "", "switched_from": "", "story": "An eBPF loophole: Using XDP for egress traffic"}]}