# eunomia-bpf/bpftime

Userspace eBPF runtime for Observability, Network, GPU & General Extensions Framework

Repository: https://github.com/eunomia-bpf/bpftime
Canonical: https://ross.abutalabs.com/products/bpftime
Homepage: https://eunomia.dev/bpftime/
Language: C++
License: MIT
License Family: permissive
Topics: ebpf, runtime, syscall-tracing, uprobes, userspace, jit, llvm, instrumentation
Last push: 2026-08-26T03:13:06+00:00

## Health v2 (maintenance only)
Score: 86/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 74, longevity 79
- inputs: {"age_days": 1119, "days_push": 7, "days_rel": 19, "gap_med": 177.5, "n_releases_24m": 3}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1558, forks 182 (observed 2026-08-28T04:05:03.424836+00:00)

## What it is
bpftime is a high-performance userspace eBPF runtime and general extension framework that lets existing eBPF tools run without kernel privileges. It supports Uprobe, USDT, syscall tracepoints, XDP, and GPU kernel hooks via LLVM JIT/AOT compilation and dynamic binary rewriting.

## Use cases
- trace function calls with uprobes without kernel privileges
- hook and filter syscalls of a process in userspace
- run eBPF tools like bpftrace or BCC on systems without kernel eBPF support
- instrument GPU kernels with eBPF programs
- attach eBPF programs to processes without restarting them
- build custom runtime extensions without modifying the kernel
- speed up uprobe-based observability by an order of magnitude

## When to choose
- you need eBPF functionality on older kernels or restricted environments without root
- you want faster uprobe/USDT/syscall tracing than kernel eBPF provides
- you need to trace or extend GPU kernel execution
- you want to prototype new eBPF program types or event sources without kernel changes

## When to avoid
- you need kernel-level networking features like tc or full XDP offload
- you require deep kernel-space observability such as kprobes on kernel functions
- your tooling depends strictly on in-kernel eBPF maps and verifier behavior

## Facets
- artifact type: library
- maturity: active
- function: monitoring, tracing, interpreter
- domain: developer-tools, performance, monitoring, operating-systems
- platform: cpp
- tags: ebpf, userspace-runtime, uprobe, syscall-tracing, usdt, xdp, llvm-jit, gpu-tracing, dynamic-binary-rewriting, jit, instrumentation, linux, gpu

## Member repositories
- eunomia-bpf/bpftime (main) score 86

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:03.424836+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:29:53.646248+00:00, confidence not recorded.
  - readme: https://github.com/eunomia-bpf/bpftime (fetched 2026-08-28T04:05:03.424836+00:00, sha c3bf0f8adccf)
  - homepage: https://eunomia.dev/bpftime/ (fetched 2026-08-29T11:29:44.368328+00:00, sha 2ced47bead8c)
  - site_page: https://eunomia.dev/others (fetched 2026-08-29T11:29:44.377338+00:00, sha 93948ca37022)
  - site_page: https://eunomia.dev/bpftime/documents/introduction (fetched 2026-08-29T11:29:44.379251+00:00, sha 365747ed7266)
- Data as of 2026-08-30T08:39:29.467469+00:00.