Linux Kernel

Overview eBPF (Extended Berkeley Packet Filter) is one of the most revolutionary technologies in the Linux kernel over the past decade. It allows developers to safely and efficiently run custom programs in kernel space — without modifying kernel source code or loading kernel modules. From network packet filtering to syscall tracing, from performance analysis to security auditing, eBPF has become the cornerstone of modern observability and network data planes. This article starts with the fundamental principles of eBPF, progressively covering development environment setup, program type selection, a practical comparison between BCC and libbpf+CO-RE, and finally a complete production-grade eBPF tool development workflow....

eBPF: The Kernel Programmability Revolution Traditional performance analysis tools fall into two categories: “overview” tools like top, vmstat, and iostat that tell you what’s happening at the system level but lack detail; and “tracing” tools like strace and gdb that show detail but incur massive overhead, making them impractical for production. eBPF (Extended Berkeley Packet Filter) changed everything. It allows you to run sandboxed programs in the kernel without modifying kernel source code or loading kernel modules....

Overview In today’s era of cloud-native and containerized technologies, Linux cgroups (control groups) serve as the kernel-level foundation for resource isolation and limiting. From Docker container memory limits to Kubernetes Pod CPU Requests/Limits, the underlying mechanism relies on cgroups. However, cgroup v1’s multi-hierarchy architecture, inconsistent controller behavior, and confusing thread model have caused numerous operational headaches in production. cgroup v2, as a complete reimagining of v1, adopts a unified hierarchy architecture that fundamentally addresses v1’s design flaws....