cilium/ebpf

Health v2 · maintenance only

Adoption not part of the score

7933 stars · 884 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ebpf-go is a pure-Go library for loading, modifying, and attaching eBPF programs to hooks in the Linux kernel, with no dependency on libbpf or CGo. It includes tooling like bpf2go for compiling and embedding eBPF C programs into Go binaries, plus packages for links, maps, BTF, and kernel feature detection.

Use cases

• load and attach eBPF programs from a Go application
• compile eBPF C code and embed it in a Go binary with bpf2go
• attach XDP programs to count or filter network packets
• probe which eBPF features the running Linux kernel supports
• read perf event arrays and ring buffers from eBPF maps
• build self-contained portable eBPF tools without libbpf or CGo
• trace and observe systems from a long-running Go process

When to choose

• you're writing Go applications that use eBPF and want a pure-Go, dependency-light library
• you need portable, self-contained eBPF tooling across architectures
• you want to compile and embed eBPF C programs directly in your Go build
• you need kernel feature detection to support multiple kernel versions

When to avoid

• you're not on Linux, as eBPF is Linux-kernel-specific
• you need a language other than Go for loading eBPF programs
• you want a ready-made observability or security product rather than a library to build one

Facets

library · maturity stable

developer-tools monitoring networking security tracing parser developer-tools networking security monitoring operating-systems performance go cli ebpf bpf btf xdp kernel bpf2go libbpf-alternative pure-go observability packet-filtering linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cilium/ebpf")