eunomia-bpf/bpftime

Health v2 · maintenance only

Adoption not part of the score

1558 stars · 182 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

bpftime is a high-performance userspace eBPF runtime and general extension framework that lets existing eBPF tools run without kernel privileges. It supports Uprobe, USDT, syscall tracepoints, XDP, and GPU kernel hooks via LLVM JIT/AOT compilation and dynamic binary rewriting.

Use cases

• trace function calls with uprobes without kernel privileges
• hook and filter syscalls of a process in userspace
• run eBPF tools like bpftrace or BCC on systems without kernel eBPF support
• instrument GPU kernels with eBPF programs
• attach eBPF programs to processes without restarting them
• build custom runtime extensions without modifying the kernel
• speed up uprobe-based observability by an order of magnitude

When to choose

• you need eBPF functionality on older kernels or restricted environments without root
• you want faster uprobe/USDT/syscall tracing than kernel eBPF provides
• you need to trace or extend GPU kernel execution
• you want to prototype new eBPF program types or event sources without kernel changes

When to avoid

• you need kernel-level networking features like tc or full XDP offload
• you require deep kernel-space observability such as kprobes on kernel functions
• your tooling depends strictly on in-kernel eBPF maps and verifier behavior

Facets

library · maturity active

monitoring tracing interpreter developer-tools performance monitoring operating-systems cpp ebpf userspace-runtime uprobe syscall-tracing usdt xdp llvm-jit gpu-tracing dynamic-binary-rewriting jit instrumentation linux gpu

Member repositories

For agents

markdown · JSON · MCP: product_card(name="eunomia-bpf/bpftime")