DevOps · Flashcard
What is eBPF?
- AA technology to run sandboxed programs in the Linux kernel — without changing kernel source or loading modules
- BA userspace networking library — bypassing the kernel to process packets entirely in application memory
- CA kernel module framework — where custom C modules are compiled against and linked into the running kernel
- DA container runtime interface — letting the kubelet start and stop pods through a standard kernel API
Why this is the answer
eBPF lets you run small verified programs inside the kernel at defined hooks, extending it safely without patching source or loading modules. It is not a userspace/kernel-bypass library, not the traditional kernel-module mechanism it was designed to avoid, and not a container runtime interface.
Official docs