doc.go (1358B)
1 // Package ebpf is a toolkit for working with eBPF programs. 2 // 3 // eBPF programs are small snippets of code which are executed directly 4 // in a VM in the Linux kernel, which makes them very fast and flexible. 5 // Many Linux subsystems now accept eBPF programs. This makes it possible 6 // to implement highly application specific logic inside the kernel, 7 // without having to modify the actual kernel itself. 8 // 9 // This package is designed for long-running processes which 10 // want to use eBPF to implement part of their application logic. It has no 11 // run-time dependencies outside of the library and the Linux kernel itself. 12 // eBPF code should be compiled ahead of time using clang, and shipped with 13 // your application as any other resource. 14 // 15 // Use the link subpackage to attach a loaded program to a hook in the kernel. 16 // 17 // Note that losing all references to Map and Program resources will cause 18 // their underlying file descriptors to be closed, potentially removing those 19 // objects from the kernel. Always retain a reference by e.g. deferring a 20 // Close() of a Collection or LoadAndAssign object until application exit. 21 // 22 // Special care needs to be taken when handling maps of type ProgramArray, 23 // as the kernel erases its contents when the last userspace or bpffs 24 // reference disappears, regardless of the map being in active use. 25 package ebpf