--- title: An eBPF overview, part 1: Introduction | daily.dev description: A foundational introduction to eBPF — the register-based, 64-bit RISC virtual machine embedded in the Linux kernel. Covers why eBPF exists (safety vs. raw... canonical: https://daily.dev/posts/an-ebpf-overview-part-1-introduction-p7htgiog7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: An eBPF overview, part 1: Introduction | daily.dev og:description: A foundational introduction to eBPF — the register-based, 64-bit RISC virtual machine embedded in the Linux kernel. Covers why eBPF exists (safety vs. raw... og:url: https://daily.dev/posts/an-ebpf-overview-part-1-introduction-p7htgiog7 og:image: https://api.daily.dev/og/posts/p7hTGioG7.png og:image:alt: An eBPF overview, part 1: Introduction og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # An eBPF overview, part 1: Introduction **[Collabora Blog](https://daily.dev/sources/collabora)** · 9 min read · 0 upvotes · 0 comments ## Summary A foundational introduction to eBPF — the register-based, 64-bit RISC virtual machine embedded in the Linux kernel. Covers why eBPF exists (safety vs. raw kernel modules), its design constraints (no loops, bounded memory, max 4096 instructions, DAG verification), the lifecycle of an eBPF program (bytecode submission, kernel verification, JIT compilation, map-based data sharing), and the bpf() syscall ABI introduced in kernel v3.18. Includes a walkthrough of the sock_example.c kernel sample, showing how to create a BPF map, define bytecode instructions using kernel macros, load the program via libbpf's bpf_load_program, attach it to a raw socket, and poll shared maps from userspace. Also mentions uBPF (Apache-licensed userspace alternative) and previews upcoming parts on bytecode details and higher-level tooling. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the safety restrictions that make eBPF programs safe to run inside the Linux kernel? eBPF programs are intentionally not Turing complete: no loops are allowed (bounded loops are work-in-progress), all memory access is bounded and type-checked including registers, there are no null dereferences, and a program may have at most BPF_MAXINSNS instructions (default 4096). The main function takes a single argument. These constraints let the kernel verifier parse the program into a directed-acyclic-graph and confirm correctness before execution. _Developers building kernel observability tools track eBPF verifier changes and new kernel capabilities on daily.dev._ ### When was the eBPF bpf() syscall introduced and what did it expose to userspace? The bpf() syscall was introduced in kernel v3.18, exposing the eBPF VM to userspace via the syscall and the uapi/linux/bpf.h header. This caused a freeze of the instruction set present at that time, making it a stable public ABI, though new instructions can still be added afterward. _Engineers working close to the kernel surface keep up with Linux ABI changes like this on daily.dev._ ### What is the difference between eBPF and KVM in the Linux kernel? eBPF is a register-based virtual machine using a custom 64-bit RISC instruction set that runs JIT-compiled programs inside the Linux kernel for tracing, filtering, and monitoring. KVM (Kernel-based VM) is a separate kernel module that enables Linux to act as a hypervisor for running full guest operating systems. They are unrelated despite both being called VMs. _Systems engineers choosing between Linux kernel instrumentation approaches find relevant comparisons on daily.dev._ ## Similar posts on daily.dev - [eBPF the Hard Way](https://daily.dev/posts/ebpf-the-hard-way-ru1cateai) · Lobsters · 1 upvotes · 0 comments - [What Is eBPF? Use Cases, Benefits, and Key Differences](https://daily.dev/posts/what-is-ebpf-use-cases-benefits-and-key-differences-5dgqadloo) · Isovalent · 3 upvotes · 0 comments - [eBPF on Hard Mode](https://daily.dev/posts/ebpf-on-hard-mode-xc9nqtwhy) · Lobsters · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/an-ebpf-overview-part-1-introduction-p7htgiog7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"An eBPF overview, part 1: Introduction","url":"https://daily.dev/posts/an-ebpf-overview-part-1-introduction-p7htgiog7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/an-ebpf-overview-part-1-introduction-p7htgiog7"},"datePublished":"2026-08-11T08:57:16.905Z","dateModified":"2026-08-11T09:38:27.901Z","description":"A foundational introduction to eBPF — the register-based, 64-bit RISC virtual machine embedded in the Linux kernel. Covers why eBPF exists (safety vs. raw...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/140fd8a5360e71e2ff83bcb6859ef2ff?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/140fd8a5360e71e2ff83bcb6859ef2ff?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collabora Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collabora Blog","logo":"https://media.daily.dev/image/upload/s--ZGZ0FjqS--/f_auto,q_auto/v1786438306/logos/collabora?_a=BAMAMicg0","url":"https://daily.dev/sources/collabora"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/an-ebpf-overview-part-1-introduction-p7htgiog7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collabora Blog","item":"https://daily.dev/sources/collabora"},{"@type":"ListItem","position":3,"name":"An eBPF overview, part 1: Introduction"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/an-ebpf-overview-part-1-introduction-p7htgiog7#faq","mainEntity":[{"@type":"Question","name":"What are the safety restrictions that make eBPF programs safe to run inside the Linux kernel?","acceptedAnswer":{"@type":"Answer","text":"eBPF programs are intentionally not Turing complete: no loops are allowed (bounded loops are work-in-progress), all memory access is bounded and type-checked including registers, there are no null dereferences, and a program may have at most BPF_MAXINSNS instructions (default 4096). The main function takes a single argument. These constraints let the kernel verifier parse the program into a directed-acyclic-graph and confirm correctness before execution. Developers building kernel observability tools track eBPF verifier changes and new kernel capabilities on daily.dev."}},{"@type":"Question","name":"When was the eBPF bpf() syscall introduced and what did it expose to userspace?","acceptedAnswer":{"@type":"Answer","text":"The bpf() syscall was introduced in kernel v3.18, exposing the eBPF VM to userspace via the syscall and the uapi/linux/bpf.h header. This caused a freeze of the instruction set present at that time, making it a stable public ABI, though new instructions can still be added afterward. Engineers working close to the kernel surface keep up with Linux ABI changes like this on daily.dev."}},{"@type":"Question","name":"What is the difference between eBPF and KVM in the Linux kernel?","acceptedAnswer":{"@type":"Answer","text":"eBPF is a register-based virtual machine using a custom 64-bit RISC instruction set that runs JIT-compiled programs inside the Linux kernel for tracing, filtering, and monitoring. KVM (Kernel-based VM) is a separate kernel module that enables Linux to act as a hypervisor for running full guest operating systems. They are unrelated despite both being called VMs. Systems engineers choosing between Linux kernel instrumentation approaches find relevant comparisons on daily.dev."}}]} ```