Learning eBPF by Liz Rice – O’Reilly Programming Guide for Linux Kernel Development

Master Linux Kernel Programming with Learning eBPF – The Complete Developer’s Guide to Building High-Performance Observability and Security Tools

About the Book

Learning eBPF is your comprehensive guide to understanding and implementing extended Berkeley Packet Filter (eBPF) technology in Linux environments. This practical book demystifies eBPF programming, showing you how to write efficient, kernel-level code that monitors, secures, and optimizes system performance without compromising safety or speed. Whether you’re building observability platforms, implementing security policies, or creating network solutions, this book provides the knowledge and real-world examples you need to succeed.

From the Back Cover

“eBPF is fundamentally transforming how we build tools for observability, security, and networking. This book gives you the practical skills to harness its full potential and build production-ready solutions.”

About the Author

Liz Rice is Chief Open Source Officer at Isovalent and a leading authority on cloud native technologies, security, and eBPF. As chair of the CNCF Technical Oversight Committee and a keynote speaker at major technology conferences worldwide, she brings deep expertise and real-world insights to this comprehensive guide. Her ability to explain complex concepts clearly makes advanced kernel programming accessible to developers at all levels.

Who Is This Book For?

This book is perfect for software developers, DevOps engineers, SRE professionals, and system administrators who want to build next-generation tools for monitoring, security, and performance optimization. If you’re working with Kubernetes, cloud infrastructure, or Linux systems and need deeper visibility and control, this guide will transform how you approach system-level programming. No prior eBPF experience required—just basic C programming knowledge and curiosity about kernel-level development.

What You’ll Learn

By reading Learning eBPF, you’ll gain hands-on experience writing eBPF programs that attach to kernel events, trace system calls, and implement security policies dynamically. You’ll understand the eBPF virtual machine, learn to use popular frameworks like libbpf and BCC, and discover how companies are using eBPF to solve real infrastructure challenges. The book bridges theory and practice, giving you confidence to build production-grade tools that enhance observability, strengthen security, and improve network performance across your entire stack.

Frequently Asked Questions (FAQs)

Q: Do I need kernel programming experience to learn eBPF?
No, you don’t need prior kernel development experience. The book starts with fundamentals and builds up gradually. Basic C programming knowledge and familiarity with Linux systems will help you get the most from this guide.

Q: What tools and frameworks does Learning eBPF cover?
The book covers essential eBPF development tools including BCC (BPF Compiler Collection), libbpf, bpftrace, and CO-RE (Compile Once – Run Everywhere). You’ll learn when to use each tool and how to choose the right approach for your projects.

Q: Can I use eBPF for cloud native and Kubernetes environments?
Absolutely. eBPF is widely used in cloud native infrastructure for service mesh observability, network security, and performance monitoring. The book includes real-world examples relevant to containerized and Kubernetes environments.

Q: Is this book suitable for building security tools with eBPF?
Yes, security is a major focus. You’ll learn how to implement runtime security monitoring, detect suspicious behavior, and enforce security policies dynamically—all without modifying application code or kernel source.

Q: How long does it take to become proficient in eBPF programming?
With this book’s structured approach, you can start writing functional eBPF programs within weeks. Building production-ready tools will take longer, but the book provides clear pathways from beginner concepts to advanced implementation patterns used by leading tech companies.