Extended Berkeley Packet Filter (eBPF) is an innovative technology derived from the Linux kernel that allows sandboxed programs to run within the operating system kernel. It can safely and efficiently extend the kernel’s functionality without loading kernel modules or changing the source code.
Operating systems have traditionally been the best place to implement security, observability, and networking features, given the kernel’s authority to monitor and control the entire system. The operating system kernel is resistant to evolution due to its key role and high requirements for security and stability. As a result, operating system-level innovation has been slow compared to features implemented externally.
eBPF radically changes this formula by allowing sandboxed programs to run in the operating system. Application development teams can use eBPF programs to provide additional functionality at runtime. The operating system uses a just-in-time (JIT) compiler and validation engine to ensure secure and efficient execution, similar to native compilation.