In this lesson, you will learn how to write and load raw BPF bytecode to hook into arbitrary kernel events for real-time observability across containerized environments.
Moving Beyond Pre-defined Hooks
While tools like tc or XDP allow you to intercept packets, "deep observability" requires looking inside the kernel's execution flow. eBPF allows you to attach programs to any function entry or exit point within the kernel (using kprobes) or user-space applications (using uprobes). Unlike ftrace, which logs events to a buffer for later analysis, eBPF allows you to perform in-kernel computation.
When you write BPF bytecode, you are essentially defining a mini-program that runs in a sandbox. Instead of dumping every packet or syscall to user-space, your eBPF program can perform aggregations, filter noisy events, or store state in BPF maps before the kernel even finishes its task.
Example: Hooking a Kernel Function
Imagine you want to monitor whenever a container attempts to open a sensitive file. You can attach a BPF program to the do_sys_open kernel function. The BPF bytecode would look conceptually like this:
// Simplified logic for a Kprobe hook
SEC("kprobe/do_sys_open")
int trace_open(struct pt_regs *ctx) {
u64 pid = bpf_get_current_pid_tgid();
// Use a BPF map to store the count of open calls per PID
u64 *val = bpf_map_lookup_elem(&pid_map, &pid);
if (val) {
(*val)++;
}
return 0;
}
By loading this bytecode, the kernel executes your logic every time the function is called. Because the BPF program runs in the kernel context, you gain visibility into namespaces, process IDs, and memory structures that are difficult to correlate from user-space monitoring tools.
Why This Matters for Namespaces
In containerized environments, host-level metrics often miss the context of which specific namespace triggered an event. With eBPF, you can retrieve the task's namespace ID (ns_inum) directly from the task_struct during the hook execution. This allows you to build telemetry that distinguishes between "host" activity and "containerized" activity in real-time, without context-switching overhead.
Key Takeaway: eBPF provides deep observability by executing custom bytecode directly within the kernel, enabling real-time aggregation and filtering of internal events without the performance penalty of traditional tracing tools.