eBPF
/ ee-bee-PEE-eff /
eBPF is a technology that lets you safely run small custom programs inside the operating-system kernel, without rewriting the kernel or restarting the machine. Normally kernel code is sacred — a bug there can crash everything, so you cannot just inject your own. eBPF is like giving a trusted visitor a locked, supervised sandbox deep inside the engine room: they can attach a tiny pre-checked program to a chosen spot, watch what happens or even shape behaviour, but they provably cannot wander off and break things.
It works by combining a tiny virtual machine with a verifier. You write a small program (often to observe events), and before the kernel will run it, an in-kernel verifier statically checks that the program is safe: it cannot loop forever, cannot read arbitrary memory, and will always terminate. Only if it passes is it allowed to attach to a hook — a network packet arriving, a system call being made, a function being entered, a trace point firing — and run at that exact moment, recording data into shared maps that user-space tools can read. The original BPF only filtered network packets; extended BPF (eBPF) generalized this into safe programmability for tracing, performance analysis, networking, and security policy. Modern tracing tools, fast networking and load balancing, and runtime security monitors are increasingly built on it.
The honest framing is that eBPF embodies a frontier idea: making the kernel programmable and extensible while staying safe by verification rather than by trust. That safety is real but bounded — it guarantees the program will not crash or hang the kernel and stays within its sandbox, not that what you wrote is correct or that it adds no overhead. And eBPF is deliberately limited (no unbounded loops, restricted operations) precisely so the verifier can prove it safe; it is a constrained, checkable language, not a way to run arbitrary code in the kernel.
To find which processes are opening the most files, you attach a tiny eBPF program to the open system call. Each time any program calls open, your code runs in the kernel and bumps a counter in a shared map keyed by process name. A user-space tool reads the map and prints the top offenders — all with no kernel changes and almost no overhead.
A verified mini-program runs inside the kernel, safely, at the exact event.
Verified safe does not mean correct. The verifier guarantees an eBPF program cannot crash or hang the kernel and stays in its sandbox — it cannot guarantee your logic is right or that the program adds no measurable cost.