A deep dive into writing eBPF programs at the raw bytecode level without libbpf, LLVM, or GCC, using Zig as the host language. Covers the full workflow: loading programs via the bpf() syscall, using eBPF maps for kernel-userspace data sharing, writing socket filter and sk_skb programs, and constructing BTF (BPF Type Format) objects manually to satisfy the verifier for features like subprograms, callbacks (bpf_loop), and KFuncs (bpf_strcmp). Includes working code examples for a packet filter that drops packets containing 'foobar', privilege requirements (CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON), and parsing btf_vmlinux to look up KFunc BTF IDs at runtime. A Nix flake for running the examples in QEMU is also provided.
153 Impressions