github.com/kubeshark/ebpf@v0.9.2/README.md (about)

     1  # eBPF
     2  
     3  [![PkgGoDev](https://pkg.go.dev/badge/github.com/kubeshark/ebpf)](https://pkg.go.dev/github.com/kubeshark/ebpf)
     4  
     5  ![HoneyGopher](.github/images/cilium-ebpf.png)
     6  
     7  eBPF is a pure Go library that provides utilities for loading, compiling, and
     8  debugging eBPF programs. It has minimal external dependencies and is intended to
     9  be used in long running processes.
    10  
    11  The library is maintained by [Cloudflare](https://www.cloudflare.com) and
    12  [Cilium](https://www.cilium.io).
    13  
    14  See [ebpf.io](https://ebpf.io) for other projects from the eBPF ecosystem.
    15  
    16  ## Getting Started
    17  
    18  A small collection of Go and eBPF programs that serve as examples for building
    19  your own tools can be found under [examples/](examples/).
    20  
    21  Contributions are highly encouraged, as they highlight certain use cases of
    22  eBPF and the library, and help shape the future of the project.
    23  
    24  ## Getting Help
    25  
    26  Please
    27  [join](https://ebpf.io/slack) the
    28  [#ebpf-go](https://cilium.slack.com/messages/ebpf-go) channel on Slack if you
    29  have questions regarding the library.
    30  
    31  ## Packages
    32  
    33  This library includes the following packages: 
    34  
    35  * [asm](https://pkg.go.dev/github.com/kubeshark/ebpf/asm) contains a basic
    36    assembler, allowing you to write eBPF assembly instructions directly
    37    within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
    38  * [cmd/bpf2go](https://pkg.go.dev/github.com/kubeshark/ebpf/cmd/bpf2go) allows
    39    compiling and embedding eBPF programs written in C within Go code. As well as
    40    compiling the C code, it auto-generates Go code for loading and manipulating
    41    the eBPF program and map objects. 
    42  * [link](https://pkg.go.dev/github.com/kubeshark/ebpf/link) allows attaching eBPF
    43    to various hooks
    44  * [perf](https://pkg.go.dev/github.com/kubeshark/ebpf/perf) allows reading from a
    45    `PERF_EVENT_ARRAY`
    46  * [ringbuf](https://pkg.go.dev/github.com/kubeshark/ebpf/ringbuf) allows reading from a
    47    `BPF_MAP_TYPE_RINGBUF` map
    48  * [features](https://pkg.go.dev/github.com/kubeshark/ebpf/features) implements the equivalent
    49    of `bpftool feature probe` for discovering BPF-related kernel features using native Go.
    50  * [rlimit](https://pkg.go.dev/github.com/kubeshark/ebpf/rlimit) provides a convenient API to lift
    51    the `RLIMIT_MEMLOCK` constraint on kernels before 5.11.
    52  
    53  ## Requirements
    54  
    55  * A version of Go that is [supported by
    56    upstream](https://golang.org/doc/devel/release.html#policy)
    57  * Linux >= 4.9. CI is run against kernel.org LTS releases. 4.4 should work but is
    58    not tested against.
    59  
    60  ## Regenerating Testdata
    61  
    62  Run `make` in the root of this repository to rebuild testdata in all
    63  subpackages. This requires Docker, as it relies on a standardized build
    64  environment to keep the build output stable.
    65  
    66  It is possible to regenerate data using Podman by overriding the `CONTAINER_*`
    67  variables: `CONTAINER_ENGINE=podman CONTAINER_RUN_ARGS= make`.
    68  
    69  The toolchain image build files are kept in [testdata/docker/](testdata/docker/).
    70  
    71  ## License
    72  
    73  MIT
    74  
    75  ### eBPF Gopher
    76  
    77  The eBPF honeygopher is based on the Go gopher designed by Renee French.