README.md (3008B)
1 # eBPF 2 3 [](https://pkg.go.dev/github.com/cilium/ebpf) 4 5  6 7 eBPF is a pure Go library that provides utilities for loading, compiling, and 8 debugging eBPF programs. It has minimal external dependencies and is intended to 9 be used in long running processes. 10 11 The library is maintained by [Cloudflare](https://www.cloudflare.com) and 12 [Cilium](https://www.cilium.io). 13 14 See [ebpf.io](https://ebpf.io) for other projects from the eBPF ecosystem. 15 16 ## Getting Started 17 18 A small collection of Go and eBPF programs that serve as examples for building 19 your own tools can be found under [examples/](examples/). 20 21 Contributions are highly encouraged, as they highlight certain use cases of 22 eBPF and the library, and help shape the future of the project. 23 24 ## Getting Help 25 26 Please 27 [join](https://ebpf.io/slack) the 28 [#ebpf-go](https://cilium.slack.com/messages/ebpf-go) channel on Slack if you 29 have questions regarding the library. 30 31 ## Packages 32 33 This library includes the following packages: 34 35 * [asm](https://pkg.go.dev/github.com/cilium/ebpf/asm) contains a basic 36 assembler, allowing you to write eBPF assembly instructions directly 37 within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.) 38 * [cmd/bpf2go](https://pkg.go.dev/github.com/cilium/ebpf/cmd/bpf2go) allows 39 compiling and embedding eBPF programs written in C within Go code. As well as 40 compiling the C code, it auto-generates Go code for loading and manipulating 41 the eBPF program and map objects. 42 * [link](https://pkg.go.dev/github.com/cilium/ebpf/link) allows attaching eBPF 43 to various hooks 44 * [perf](https://pkg.go.dev/github.com/cilium/ebpf/perf) allows reading from a 45 `PERF_EVENT_ARRAY` 46 * [ringbuf](https://pkg.go.dev/github.com/cilium/ebpf/ringbuf) allows reading from a 47 `BPF_MAP_TYPE_RINGBUF` map 48 * [features](https://pkg.go.dev/github.com/cilium/ebpf/features) implements the equivalent 49 of `bpftool feature probe` for discovering BPF-related kernel features using native Go. 50 * [rlimit](https://pkg.go.dev/github.com/cilium/ebpf/rlimit) provides a convenient API to lift 51 the `RLIMIT_MEMLOCK` constraint on kernels before 5.11. 52 53 ## Requirements 54 55 * A version of Go that is [supported by 56 upstream](https://golang.org/doc/devel/release.html#policy) 57 * Linux >= 4.9. CI is run against kernel.org LTS releases. 4.4 should work but is 58 not tested against. 59 60 ## Regenerating Testdata 61 62 Run `make` in the root of this repository to rebuild testdata in all 63 subpackages. This requires Docker, as it relies on a standardized build 64 environment to keep the build output stable. 65 66 It is possible to regenerate data using Podman by overriding the `CONTAINER_*` 67 variables: `CONTAINER_ENGINE=podman CONTAINER_RUN_ARGS= make`. 68 69 The toolchain image build files are kept in [testdata/docker/](testdata/docker/). 70 71 ## License 72 73 MIT 74 75 ### eBPF Gopher 76 77 The eBPF honeygopher is based on the Go gopher designed by Renee French.