libbpfgo-beginners
Basic eBPF examples in Golang using libbpfgo.
- Accompanying slides from my talk at GOTOpia 2021 called Beginner's Guide to eBPF Programming in Go
- See also my original Python examples from my Beginner's Guide to eBPF talk
Install Go
Install packages
sudo apt-get update
sudo apt-get install libbpf-dev make clang llvm libelf-dev
Building and running hello
make all
sudo ./hello
This builds two things:
- dist/hello.bpf.o - an object file for the eBPF program
- hello - a Go executable
The Go executable reads in the object file at runtime. Take a look at the .o file with readelf if you want to see the sections defined in it.
Docker
To avoid compatibility issues, you can use the Dockerfile
provided in this repository.
Build it by your own:
docker build -t hello .
And the run it from the project directory to compile the program:
docker run --rm -v $(pwd)/:/app/:z hello
Notes
I'm using Ubuntu 20.10, kernel 5.8, go 1.15
This approach installs the libbpf-dev package. Another alternative (which is what Tracee does) is to install the libbpf source as a git submodule, build it from source and install it to the expected location (e.g. /usr/lib/x86_64-linux-gnu/libbpf.a
on an Intel x86 processor).