README.md

Documentation: github.com/cilium/ebpf

     1# eBPF
     2
     3[![PkgGoDev](https://pkg.go.dev/badge/github.com/cilium/ebpf)](https://pkg.go.dev/github.com/cilium/ebpf)
     4
     5![HoneyGopher](.github/images/cilium-ebpf.png)
     6
     7eBPF is a pure Go library that provides utilities for loading, compiling, and
     8debugging eBPF programs. It has minimal external dependencies and is intended to
     9be used in long running processes.
    10
    11The library is maintained by [Cloudflare](https://www.cloudflare.com) and
    12[Cilium](https://www.cilium.io).
    13
    14See [ebpf.io](https://ebpf.io) for other projects from the eBPF ecosystem.
    15
    16## Getting Started
    17
    18A small collection of Go and eBPF programs that serve as examples for building
    19your own tools can be found under [examples/](examples/).
    20
    21Contributions are highly encouraged, as they highlight certain use cases of
    22eBPF and the library, and help shape the future of the project.
    23
    24## Getting Help
    25
    26Please
    27[join](https://ebpf.io/slack) the
    28[#ebpf-go](https://cilium.slack.com/messages/ebpf-go) channel on Slack if you
    29have questions regarding the library.
    30
    31## Packages
    32
    33This library includes the following packages: 
    34
    35* [asm](https://pkg.go.dev/github.com/cilium/ebpf/asm) contains a basic
    36  assembler, allowing you to write eBPF assembly instructions directly
    37  within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
    38* [cmd/bpf2go](https://pkg.go.dev/github.com/cilium/ebpf/cmd/bpf2go) allows
    39  compiling and embedding eBPF programs written in C within Go code. As well as
    40  compiling the C code, it auto-generates Go code for loading and manipulating
    41  the eBPF program and map objects. 
    42* [link](https://pkg.go.dev/github.com/cilium/ebpf/link) allows attaching eBPF
    43  to various hooks
    44* [perf](https://pkg.go.dev/github.com/cilium/ebpf/perf) allows reading from a
    45  `PERF_EVENT_ARRAY`
    46* [ringbuf](https://pkg.go.dev/github.com/cilium/ebpf/ringbuf) allows reading from a
    47  `BPF_MAP_TYPE_RINGBUF` map
    48* [features](https://pkg.go.dev/github.com/cilium/ebpf/features) implements the equivalent
    49  of `bpftool feature probe` for discovering BPF-related kernel features using native Go.
    50* [rlimit](https://pkg.go.dev/github.com/cilium/ebpf/rlimit) provides a convenient API to lift
    51  the `RLIMIT_MEMLOCK` constraint on kernels before 5.11.
    52
    53## Requirements
    54
    55* A version of Go that is [supported by
    56  upstream](https://golang.org/doc/devel/release.html#policy)
    57* Linux >= 4.9. CI is run against kernel.org LTS releases. 4.4 should work but is
    58  not tested against.
    59
    60## Regenerating Testdata
    61
    62Run `make` in the root of this repository to rebuild testdata in all
    63subpackages. This requires Docker, as it relies on a standardized build
    64environment to keep the build output stable.
    65
    66It is possible to regenerate data using Podman by overriding the `CONTAINER_*`
    67variables: `CONTAINER_ENGINE=podman CONTAINER_RUN_ARGS= make`.
    68
    69The toolchain image build files are kept in [testdata/docker/](testdata/docker/).
    70
    71## License
    72
    73MIT
    74
    75### eBPF Gopher
    76
    77The eBPF honeygopher is based on the Go gopher designed by Renee French.
View as plain text