This repository contains multiple demos showcasing the usage of eBPF with Cilium for Go applications. Each demo is designed to highlight different aspects of eBPF and its interaction with Go applications, including uProbes, uRetprobes, and function execution time tracking.
Each folder within this repository contains a specific demo illustrating a unique feature of eBPF and its integration with Go applications. The demos include:
For more details on each demo, please refer to the README file within the respective demo folder.
To run these demos, you need a Linux system with the following tools and packages installed:
- Linux Kernel: Version 4.15 or higher with BPF enabled.
- bcc tools: BPF Compiler Collection tools.
- clang and llvm: Required for compiling eBPF programs.
- Go: Version 1.22 or higher.
graph TD
subgraph User Space
A[Go Application]
B[Tracing Application]
end
subgraph System Call Interface
C[System Calls]
end
subgraph Kernel Space
D[eBPF Program]
E[uprobe - Store Start Time in Hash Map]
F[Hash Map - Start Times]
G[Ring Buffer - Events]
end
A -->|Makes HTTP Request| A2[Go demo Function]
B -->|Setup uprobe using System Calls| C
C -->|Load eBPF Program and Setup Probes| D
D --> E
E -->|Store Start Time in Hash Map| F
E -->|Store Result in Ring Buffer| G
G --> I[Tracing Application Reads Data from Ring Buffer]
B -->|Read Data from Ring Buffer| I
Here are some useful resources to understand eBPF, Go, and their integration:
- Great Medium Article on BPF and Go
- Liz Rice's Talk on eBPF
- Pixie Demo on eBPF
- Cilium eBPF Documentation
- Series of good blog posts
- List of BPF helper functions
- Go opentelemetery instrumentation
This project is licensed under the MIT License - see the LICENSE file for details.