eBPF is a pure Go library that provides utilities for loading, compiling, and debugging eBPF programs. It has minimal external dependencies and is intended to be used in long running processes.

• ebpf/link allows attaching eBPF to various hooks.
• ebpf/asm contains a basic assembler.

The library is maintained by Cloudflare and Cilium. Feel free to join the libbpf-go channel on Slack.

The package is production ready, but the API is explicitly unstable right now. Expect to update your code if you want to follow along.

• A version of Go that is supported by upstream
• Linux 4.9, 4.19 or 5.4 (versions in-between should work, but are not tested)

• Cilium eBPF documentation (recommended)
• Linux documentation on BPF
• eBPF features by Linux version