--- title: An eBPF overview, part 3: Walking up the software stack description: Part 3 of an eBPF series walks through the high-level software stack built on top of the eBPF VM. It defines the four key components of an eBPF program:... canonical: https://daily.dev/posts/an-ebpf-overview-part-3-walking-up-the-software-stack-7hbiunqgs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: An eBPF overview, part 3: Walking up the software stack | daily.dev og:description: Part 3 of an eBPF series walks through the high-level software stack built on top of the eBPF VM. It defines the four key components of an eBPF program:... og:url: https://daily.dev/posts/an-ebpf-overview-part-3-walking-up-the-software-stack-7hbiunqgs og:image: https://api.daily.dev/og/posts/7HBIunqGs.png og:image:alt: An eBPF overview, part 3: Walking up the software stack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # An eBPF overview, part 3: Walking up the software stack **[Collabora Blog](https://daily.dev/sources/collabora)** · 9 min read · 0 upvotes · 0 comments ## Summary Part 3 of an eBPF series walks through the high-level software stack built on top of the eBPF VM. It defines the four key components of an eBPF program: backend, loader, frontend, and data structures. The post explains how LLVM compiles 'restricted C' to eBPF ELF objects loaded via libbpf, then introduces BCC as a higher-level framework that automates compilation and standardizes APIs using Python or Lua scripts. BPFtrace is presented as an even higher abstraction — an AWK/DTrace-inspired DSL for one-liner system analysis. The IOVisor project and its Hover framework for deploying eBPF programs at scale are also covered. The post concludes by noting that all these tools have significant disk footprints, making them unsuitable for embedded devices — a topic deferred to part 4. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between BCC and BPFtrace for eBPF programs? BCC is a framework that uses Python or Lua scripts alongside 'restricted C' to write, load, and run eBPF programs, automating LLVM compilation and standardizing data structure APIs. BPFtrace is built on top of BCC and provides an even higher-level domain-specific language inspired by AWK and DTrace, enabling one-liner system analysis. BCC is more powerful and flexible; BPFtrace is faster for ad-hoc debugging but more limited. _Engineers choosing between eBPF tooling for observability workflows track these trade-offs on daily.dev._ ### Why does LLVM support eBPF compilation but GCC does not? LLVM added an eBPF backend starting with version 3.7, released in 2015, enabling subsets of C, Go, and Rust to be compiled to eBPF. GCC did not support eBPF compilation at the time this was written. The C subset is the most developed because the Linux kernel itself is written in C, making it easier to reuse existing kernel headers. _Linux kernel developers following eBPF toolchain support changes find relevant updates on daily.dev._ ### What are the four high-level components of an eBPF program? An eBPF program is composed of a backend (the eBPF bytecode that runs in the kernel), a loader (the user-space process that parses ELF objects and loads bytecode via the bpf() syscall), data structures (BPF maps shared between kernel and user space), and a frontend (the user-space process that reads from those data structures and presents results). Multiple backends, loaders, and frontends can coexist in a single application. _Developers building eBPF-based tools keep up with ecosystem patterns on daily.dev._ ## Similar posts on daily.dev - [eBPF the Hard Way](https://daily.dev/posts/ebpf-the-hard-way-ru1cateai) · Lobsters · 1 upvotes · 0 comments - [How eBPF Empowers Developers to Observe Inside the Linux Kernel in a Safe and Unintrusive Way](https://daily.dev/posts/how-ebpf-empowers-developers-to-observe-inside-the-linux-kernel-in-a-safe-and-unintrusive-way-jhmpnwjer) · InfoQ · 0 upvotes · 0 comments - [eBPF on Hard Mode](https://daily.dev/posts/ebpf-on-hard-mode-xc9nqtwhy) · Lobsters · 0 upvotes · 0 comments - [What Is eBPF? Use Cases, Benefits, and Key Differences](https://daily.dev/posts/what-is-ebpf-use-cases-benefits-and-key-differences-5dgqadloo) · Isovalent · 3 upvotes · 0 comments --- Tags: [#general-programming](https://daily.dev/tags/general-programming), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/an-ebpf-overview-part-3-walking-up-the-software-stack-7hbiunqgs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"An eBPF overview, part 3: Walking up the software stack","url":"https://daily.dev/posts/an-ebpf-overview-part-3-walking-up-the-software-stack-7hbiunqgs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/an-ebpf-overview-part-3-walking-up-the-software-stack-7hbiunqgs"},"datePublished":"2026-08-11T08:54:17.517Z","dateModified":"2026-08-11T09:22:27.576Z","description":"Part 3 of an eBPF series walks through the high-level software stack built on top of the eBPF VM. It defines the four key components of an eBPF program:...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e159007942240c6367482d6d031f2205?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e159007942240c6367482d6d031f2205?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collabora Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collabora Blog","logo":"https://media.daily.dev/image/upload/s--ZGZ0FjqS--/f_auto,q_auto/v1786438306/logos/collabora?_a=BAMAMicg0","url":"https://daily.dev/sources/collabora"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/an-ebpf-overview-part-3-walking-up-the-software-stack-7hbiunqgs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"general-programming,linux","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collabora Blog","item":"https://daily.dev/sources/collabora"},{"@type":"ListItem","position":3,"name":"An eBPF overview, part 3: Walking up the software stack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/an-ebpf-overview-part-3-walking-up-the-software-stack-7hbiunqgs#faq","mainEntity":[{"@type":"Question","name":"What is the difference between BCC and BPFtrace for eBPF programs?","acceptedAnswer":{"@type":"Answer","text":"BCC is a framework that uses Python or Lua scripts alongside 'restricted C' to write, load, and run eBPF programs, automating LLVM compilation and standardizing data structure APIs. BPFtrace is built on top of BCC and provides an even higher-level domain-specific language inspired by AWK and DTrace, enabling one-liner system analysis. BCC is more powerful and flexible; BPFtrace is faster for ad-hoc debugging but more limited. Engineers choosing between eBPF tooling for observability workflows track these trade-offs on daily.dev."}},{"@type":"Question","name":"Why does LLVM support eBPF compilation but GCC does not?","acceptedAnswer":{"@type":"Answer","text":"LLVM added an eBPF backend starting with version 3.7, released in 2015, enabling subsets of C, Go, and Rust to be compiled to eBPF. GCC did not support eBPF compilation at the time this was written. The C subset is the most developed because the Linux kernel itself is written in C, making it easier to reuse existing kernel headers. Linux kernel developers following eBPF toolchain support changes find relevant updates on daily.dev."}},{"@type":"Question","name":"What are the four high-level components of an eBPF program?","acceptedAnswer":{"@type":"Answer","text":"An eBPF program is composed of a backend (the eBPF bytecode that runs in the kernel), a loader (the user-space process that parses ELF objects and loads bytecode via the bpf() syscall), data structures (BPF maps shared between kernel and user space), and a frontend (the user-space process that reads from those data structures and presents results). Multiple backends, loaders, and frontends can coexist in a single application. Developers building eBPF-based tools keep up with ecosystem patterns on daily.dev."}}]} ```