The State of eBPF: Exploring eBPF Evolution, Use Cases, Challenges and Future
March 12, 2024

Thomas Graf
eBPF Foundation

eBPF is a technology that allows users to run custom programs inside the Linux kernel, which changes the behavior of the kernel and makes execution up to 10x faster and more efficient for key parts of what makes our computing lives work. That includes observability, which enables engineers to see where a system is going wrong and find fixes faster; networking, which involves everything from how fast emails move to how fast computation occurs; to security, which keeps our digital lives and infrastructure safer from cyber threats.

The eBPF Foundation has released a publication titled The State of eBPF, a qualitative research report that covers the evolution of eBPF, the revolution it created, what's being built with it today, challenges, and where the technology is heading. The report provides valuable insight into how to make the most of what eBPF offers currently, plans for the future, and how stakeholders can get involved with the project to help eBPF continue to improve. Read on for key insights from the report to learn more about eBPF and how it can impact the way you develop applications.


About eBPF

The innovation of eBPF means companies need less hardware to achieve better performance and they consume less power to perform the same functionality. That makes operations more cost efficient, energy efficient, and sustainable, which is increasingly required to meet shareholder, consumer and community expectations.

eBPF was Linux only until recently. In 2021, Microsoft created the eBPF for Windows project to allow eBPF programs to run on top of the Windows OS. This laid the groundwork for eBPF to be standardized as an industry-wide infrastructure language. With a unified underlying infrastructure, companies can innovate however they want on top without risk of becoming locked in to one OS or the other.

This lack of vendor lock-in — from the browser to the database to the cloud — has historically spurred increased innovation, competition in terms of cost and performance, and is a bedrock tenet of the open source ethos that drives both Linux and eBPF.

eBPF is like a virtual machine in the Linux kernel. With eBPF, a developer writes eBPF instructions to run small specialized programs. They go to an eBPF "verifier," which checks to make sure the program is safe to add to the kernel and won't introduce bugs or crash the kernel. The program is JIT-compiled into machine code that gets executed and attached to event targets, which means the program is activated by an event, such as a file opening.

eBPF Adoption

For more than five years, eBPF has been operating on millions of devices and servers worldwide. Most people are already impacted by what companies do with it — and they probably don't know it.

Many of the US hyperscalers — Meta, Google, Netflix — use eBPF in production. Every Android phone uses eBPF to monitor traffic. Every single packet that goes in and out of a Facebook datacenter is touched by eBPF. Companies in myriad industries, including software, cloud services, financial services, telco, media and entertainment, ecommerce, consulting, and security, are increasingly using eBPF technology to do more, faster, saving time and money and increasing performance. 

Of course hyperscalers and big companies have what most companies do not have: teams of software engineers. To spread eBPF into more enterprises, open source software projects arose to make the technology consumable out-of-the box.

Here's a breakdown of three major use cases, for eBPF in production:

eBPF Use Case 1: Observability

For many companies, observability is where eBPF first took off and has had its biggest impact. With greater observability in distributed systems that might involve tens, hundreds, or thousands of servers, companies can more easily and fully know where the system is spending its time. They can see for example, where bottlenecks are occurring, how fast CPUs are working, where they're spinning cycles, and where to find, more quickly, what piece of code may be malfunctioning. By attaching eBPF programs to events like a file opening, users get metrics that provide amazing visibility into what's happening in the system.

eBPF Use Case 2: Networking

Networking is a great example of how eBPF adds speed and performance. Many parts of the Linux networking stack were written decades ago when IPs and port ranges could be tracked on spreadsheets rather than changing with every container. eBPF enables programmers to rewrite the networking stack, only leverage the needed parts, or skip it completely to save time and processing power. By bypassing things that are not needed or rewriting functionality based on new methods of building software, networking performance dramatically improves.

eBPF Use Case 3: Security

eBPF enables enhanced observability making it easier to spot and prevent security attacks, including those within the kernel as well as throughout Kubernetes and cloud native environments. eBPF also pushes security enforcement policies into distributed environments so they get implemented in real time. If a vulnerability occurs in the kernel, for instance, fast fixes can occur via eBPF without altering the kernel code, allowing for security updates on the fly.

While eBPF is already widely deployed, it is still at the beginning of the large wave of innovation it will unlock.

No doubt, eBPF will become an essential layer in the new cloud native infrastructure stack, impacting the observability, performance, reliability, networking, and security of all applications. Platform engineers will cobble together eBPF-powered infrastructure building blocks to create platforms that developers then deploy software on. These platforms will add business logic to the mix, replacing aging Linux kernel internals that cannot keep up with today's digital and, increasingly, cloud native world. 

Thomas Graf is Governing Board Chair of the eBPF Foundation
Share this

Industry News

December 19, 2024

Check Point® Software Technologies Ltd. has been recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for Email Security Platforms (ESP).

December 19, 2024

Progress announced its partnership with the American Institute of CPAs (AICPA), the world’s largest member association representing the CPA profession.

December 18, 2024

Kurrent announced $12 million in funding, its rebrand from Event Store and the official launch of Kurrent Enterprise Edition, now commercially available.

December 18, 2024

Blitzy announced the launch of the Blitzy Platform, a category-defining agentic platform that accelerates software development for enterprises by autonomously batch building up to 80% of software applications.

December 17, 2024

Sonata Software launched IntellQA, a Harmoni.AI powered testing automation and acceleration platform designed to transform software delivery for global enterprises.

December 17, 2024

Sonar signed a definitive agreement to acquire Tidelift, a provider of software supply chain security solutions that help organizations manage the risk of open source software.

December 17, 2024

Kindo formally launched its channel partner program.

December 16, 2024

Red Hat announced the latest release of Red Hat Enterprise Linux AI (RHEL AI), Red Hat’s foundation model platform for more seamlessly developing, testing and running generative artificial intelligence (gen AI) models for enterprise applications.

December 16, 2024

Fastly announced the general availability of Fastly AI Accelerator.

December 12, 2024

Amazon Web Services (AWS) announced the launch and general availability of Amazon Q Developer plugins for Datadog and Wiz in the AWS Management Console.

December 12, 2024

vFunction released new capabilities that solve a major microservices headache for development teams – keeping documentation current as systems evolve – and make it simpler to manage and remediate tech debt.

December 11, 2024

CyberArk announced the launch of FuzzyAI, an open-source framework that helps organizations identify and address AI model vulnerabilities, like guardrail bypassing and harmful output generation, in cloud-hosted and in-house AI models.

December 11, 2024

Grid Dynamics announced the launch of its developer portal.

December 10, 2024

LTIMindtree announced a strategic partnership with GitHub.