github.com/cilium/ebpf@v0.15.1-0.20240517100537-8079b37aa138/doc.go (about)

     1  // Package ebpf is a toolkit for working with eBPF programs.
     2  //
     3  // eBPF programs are small snippets of code which are executed directly
     4  // in a VM in the Linux kernel, which makes them very fast and flexible.
     5  // Many Linux subsystems now accept eBPF programs. This makes it possible
     6  // to implement highly application specific logic inside the kernel,
     7  // without having to modify the actual kernel itself.
     8  //
     9  // This package is designed for long-running processes which
    10  // want to use eBPF to implement part of their application logic. It has no
    11  // run-time dependencies outside of the library and the Linux kernel itself.
    12  // eBPF code should be compiled ahead of time using clang, and shipped with
    13  // your application as any other resource.
    14  //
    15  // Use the link subpackage to attach a loaded program to a hook in the kernel.
    16  //
    17  // Note that losing all references to Map and Program resources will cause
    18  // their underlying file descriptors to be closed, potentially removing those
    19  // objects from the kernel. Always retain a reference by e.g. deferring a
    20  // Close() of a Collection or LoadAndAssign object until application exit.
    21  //
    22  // Special care needs to be taken when handling maps of type ProgramArray,
    23  // as the kernel erases its contents when the last userspace or bpffs
    24  // reference disappears, regardless of the map being in active use.
    25  package ebpf