# cilium/ebpf

ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.

Repository: https://github.com/cilium/ebpf
Canonical: https://ross.abutalabs.com/products/ebpf
Homepage: https://ebpf-go.dev
Language: Go
License: MIT
License Family: permissive
Topics: ebpf, linux, go, golang, btf
Last push: 2026-08-25T08:12:36+00:00

## Health v2 (maintenance only)
Score: 92/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 78, longevity 100
- inputs: {"age_days": 2554, "days_push": 8, "days_rel": 65, "gap_med": 66.5, "n_releases_24m": 9}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 7933, forks 884 (observed 2026-08-28T04:10:09.897324+00:00)

## What it is
ebpf-go is a pure-Go library for loading, modifying, and attaching eBPF programs to hooks in the Linux kernel, with no dependency on libbpf or CGo. It includes tooling like bpf2go for compiling and embedding eBPF C programs into Go binaries, plus packages for links, maps, BTF, and kernel feature detection.

## Use cases
- load and attach eBPF programs from a Go application
- compile eBPF C code and embed it in a Go binary with bpf2go
- attach XDP programs to count or filter network packets
- probe which eBPF features the running Linux kernel supports
- read perf event arrays and ring buffers from eBPF maps
- build self-contained portable eBPF tools without libbpf or CGo
- trace and observe systems from a long-running Go process

## When to choose
- you're writing Go applications that use eBPF and want a pure-Go, dependency-light library
- you need portable, self-contained eBPF tooling across architectures
- you want to compile and embed eBPF C programs directly in your Go build
- you need kernel feature detection to support multiple kernel versions

## When to avoid
- you're not on Linux, as eBPF is Linux-kernel-specific
- you need a language other than Go for loading eBPF programs
- you want a ready-made observability or security product rather than a library to build one

## Facets
- artifact type: library
- maturity: stable
- function: developer-tools, monitoring, networking, security, tracing, parser
- domain: developer-tools, networking, security, monitoring, operating-systems, performance
- platform: go, cli
- tags: ebpf, bpf, btf, xdp, kernel, bpf2go, libbpf-alternative, pure-go, observability, packet-filtering, linux

## Member repositories
- cilium/ebpf (main) score 92

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:09.897324+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:21:11.132585+00:00, confidence not recorded.
  - readme: https://github.com/cilium/ebpf (fetched 2026-08-28T04:10:09.897324+00:00, sha 4f39f493d024)
  - homepage: https://ebpf-go.dev (fetched 2026-08-29T08:29:58.354244+00:00, sha e3ac1602439e)
  - site_page: https://ebpf-go.dev/guides/getting-started (fetched 2026-08-29T08:29:58.363162+00:00, sha b2b934d2ebda)
  - site_page: https://ebpf-go.dev/concepts/features (fetched 2026-08-29T08:29:58.365609+00:00, sha 3120d43f30ba)
  - site_page: https://ebpf-go.dev/about (fetched 2026-08-29T08:29:58.367598+00:00, sha d6cac075cd38)
- Data as of 2026-08-30T08:39:29.467469+00:00.