ebpf/doc.go at master · hmahmood/ebpf

Repository navigation

// Package ebpf is a toolkit for working with eBPF programs.

// eBPF programs are small snippets of code which are executed directly

// in a VM in the Linux kernel, which makes them very fast and flexible.

// Many Linux subsystems now accept eBPF programs. This makes it possible

// to implement highly application specific logic inside the kernel,

// without having to modify the actual kernel itself.

// This package is designed for long-running processes which

// want to use eBPF to implement part of their application logic. It has no

// run-time dependencies outside of the library and the Linux kernel itself.

// eBPF code should be compiled ahead of time using clang, and shipped with

// your application as any other resource.

// Use the link subpackage to attach a loaded program to a hook in the kernel.

// Note that losing all references to Map and Program resources will cause

// their underlying file descriptors to be closed, potentially removing those

// objects from the kernel. Always retain a reference by e.g. deferring a

// Close() of a Collection or LoadAndAssign object until application exit.

// Special care needs to be taken when handling maps of type ProgramArray,

// as the kernel erases its contents when the last userspace or bpffs

// reference disappears, regardless of the map being in active use.

package ebpf