Lab

Go + eBPF Development

Master the cilium/ebpf library - load programs, work with maps, and attach to network and tracing hooks

Learn how to use the cilium/ebpf library to build Go applications that leverage eBPF
for networking, observability, and tracing. This hands-on lab teaches the practical
skills needed to load, manage, and interact with eBPF programs from Go.

You'll learn to work with maps, ring buffers, XDP network hooks, and kernel tracing -
all from Go code.

• 👋 Introduction: What is cilium/ebpf?

  Learn what the cilium/ebpf library provides

• 🔄 Program Lifecycle

  Load, attach, and manage eBPF programs from Go

• 🗺️ Maps: Hash Map Operations

  Count and track process executions by PID using a BPF hash map

• 🔧 Array Maps (Configuration)

  Use array maps to send configuration into the kernel and read a counter back

• ⭕ Ring Buffer (Streaming)

  Stream real-time events from the kernel to userspace with a ring buffer

• 🌐 XDP Packet Size Histogram

  Attach an XDP program at the driver level to classify packets by size

• 🌐 TC MAC Address Discovery

  Attach TC ingress/egress programs to discover network devices by MAC address

• 📂 Track File Opens with Tracepoints

  Count file open syscalls per process using tracepoints

• 🥋 Exam Challenge

  Take the final challenge!