eBPF: Linux Observability and Systems Programming Guide

eBPF is a technology that can run sandboxed programs in the Linux kernel without changing kernel source code or loading kernel modules. By making the Linux kernel programmable, infrastructure software can leverage existing layers, making them more intelligent and feature-rich wit. Use it as a repeatable review, validation or hardening pass.