eBPF

eBPF is a technology to collect metrics and events from the {{< glossary_tooltip text="kernel" term_id="kernel" >}} in a secure way.

<!--more-->

eBPF is a technology that can run sandboxed programs in a privileged context, such as the operating system {{< glossary_tooltip text="kernel" term_id="kernel" >}}. It is used to extend the {{< glossary_tooltip text="kernel's" term_id="kernel" >}} capabilities at runtime without requiring to change {{< glossary_tooltip text="kernel" term_id="kernel" >}} source code or load {{< glossary_tooltip text="kernel modules" term_id="kernel-module" >}}. It is considered safer than {{< glossary_tooltip text="kernel modules" term_id="kernel-module" >}} since it cannot crash your system.

Ref: https://ebpf.io