--- title: "Hardening eBPF for runtime security: Lessons from Datadog Workload Protection" url: https://daily.dev/posts/hardening-ebpf-for-runtime-security-lessons-from-datadog-workload-protection-luuhfraro source_url: https://www.datadoghq.com/blog/engineering/ebpf-workload-protection-lessons/ type: article source: "eBPF" published: 2026-02-23T16:15:41.094Z updated: 2026-02-23T16:16:07.557Z tags: ["devops", "linux", "observability"] reading_time: 40 upvotes: 6 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hardening eBPF for runtime security: Lessons from Datadog Workload Protection **[eBPF](https://daily.dev/sources/ebpf)** · 40 min read · 6 upvotes · 0 comments ## Summary Datadog engineers share six hard-won lessons from five years of running eBPF-powered workload protection at scale. The post covers: navigating kernel version and distribution compatibility pitfalls (verifier changes, hook point availability, function inlining); safely capturing kernel data (CO-RE offsets, TOCTOU races, paged-out user memory, non-linear skbs); maintaining consistent eBPF maps and user-space caches (LRU eviction quirks, blocking syscall abuse, event reordering); auditing eBPF as an attack surface (rootkit potential, helper abuse, tampering detection); handling conflicts with other eBPF tools sharing kernel resources (a real Cilium TC classifier incident); and measuring both user-space agent overhead and hidden kernel instrumentation cost. Each lesson includes concrete mitigations such as CI kernel matrices, the open-source ebpf-manager library, aggressive in-kernel event filtering, and dynamic re-hooking on module reload. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [How eBPF Empowers Developers to Observe Inside the Linux Kernel in a Safe and Unintrusive Way](https://daily.dev/posts/how-ebpf-empowers-developers-to-observe-inside-the-linux-kernel-in-a-safe-and-unintrusive-way-jhmpnwjer) · InfoQ · 0 upvotes · 0 comments - [Kernel-Level Ground Truth: Why eBPF is Replacing User-Space Agents for Security Observability](https://daily.dev/posts/kernel-level-ground-truth-why-ebpf-is-replacing-user-space-agents-for-security-observability-92jvpmrxl) · InfoQ · 0 upvotes · 0 comments --- Tags: [#devops](https://daily.dev/tags/devops), [#linux](https://daily.dev/tags/linux), [#observability](https://daily.dev/tags/observability) [View this post on daily.dev](https://daily.dev/posts/hardening-ebpf-for-runtime-security-lessons-from-datadog-workload-protection-luuhfraro)