Skip to content

eBPF Developer Tutorial

Hands-on, example-driven eBPF development course based on CO-RE (Compile Once, Run Everywhere), maintained by the eunomia-bpf organization. Each lesson directory is an independent eBPF tool, starting from ~20 lines of code, progressing to frontier topics like sched_ext schedulers and GPU tracing.

Summary

The eBPF Developer Tutorial (eunomia.dev/tutorials) is an open-source curriculum teaching practical eBPF programming through ~57 self-contained tool examples, with complete source in the bpf-developer-tutorial GitHub repository. Unlike BCC-based material, it teaches modern CO-RE workflows built on libbpf, cilium/ebpf, libbpf-rs, and the eunomia-bpf framework, in C, Go, and Rust.

Evaluation

  • Why it's better: Every example is a real, runnable tool rather than a fragment. Lessons are verified by CI against per-lesson minimum-kernel requirements documented in an auto-generated compatibility matrix — rare rigor for tutorial material. Coverage extends past what most free tutorials attempt: sched_ext CPU scheduling (mainline since Linux 6.12), TCX links, BPF arena/dynptr/workqueues/token, HID drivers, CUDA tracing, NPU drivers, Android.
  • When it fits: Developers who want to write eBPF tools (tracing, networking, security enforcement), systems engineers moving beyond ready-made tools like bpftrace, and teams evaluating the modern libbpf/CO-RE stack over BCC.
  • When it doesn't: It deliberately skips deep conceptual theory and scenario walkthroughs; pair with ebpf.io/docs.ebpf.io background reading. Beginners without C basics or root-capable Linux will struggle before lesson 1.

Pros and Cons

Pros Cons
57+ runnable lessons, each an independent tool Requires root-capable Linux; macOS/Windows users need VMs
CI-verified lessons with documented minimum kernels (4.8 up to 7.0) Most early lessons use C; Go/Rust examples concentrated later
Multi-framework exposure: libbpf, cilium/ebpf (Go), libbpf-rs (Rust), eunomia-bpf English and Chinese versions occasionally drift in depth
Actively maintained (pushed July 2026), MIT licensed Some bleeding-edge lessons target unreleased kernels (7.0 features)
Curated research-paper gateway (lesson 18) No formal video course or certification-style track

Common Use Cases

  • Learning eBPF primitives: kprobe/fentry/uprobe tracing, hash maps, perf event arrays, ring buffers, histograms (lessons 0-10).
  • Building production-grade tracing tools with libbpf user-space programs: process lifecycle monitoring, TCP latency, memory-leak detection, Java GC via USDT (lessons 11-17).
  • Security engineering: LSM-based detection and defense, process hiding techniques and countermeasures, syscall argument modification, signal-based response (lessons 19, 24-28, 34, 51, 54).
  • Network engineering: XDP packet processing and load balancing, tc traffic control, sockops acceleration, TCPX/Tcx composability, egress pacing (lessons 20-21, 29, 41-42, 46, 50, 53).
  • Kernel/XPU experimentation: sched_ext scheduler implementation, GPU/NPU driver tracing, energy monitoring (lessons 44-45, 47-48, xpu tracks).

Licensing & Commercial Use

MIT license. Free for commercial and internal training use; attribution appreciated by upstream per repository request.

Ecosystem & Connections

The tutorial is the educational front door for the eunomia-bpf organization's toolchain:

  • eunomia-bpf (~900 stars) — compiler (ecc) and dynamic loader (ecli) enabling kernel-code-only authorship; compiled artifacts distributed as OCI images or Wasm modules.
  • bpftime (~1.6k stars) — user-space eBPF runtime claiming ~10x faster than kernel uprobes; supports GPU offloading and AOT/JIT compilation.
  • wasm-bpf (~440 stars) — WebAssembly library/toolchain/runtime for running eBPF from Wasm modules.
  • Starter templates — libbpf-starter-template (C), libbpf-rs-starter-template (Rust), plus Go/cilium-ebpf and eunomia-template variants; each ships Makefile, Dockerfile, and GitHub Actions build/release automation.
  • Related learning asset: companion basic-cuda-tutorial and cupti-tutorial repositories feed the GPU lessons.

Compatibility & Requirements

  • Linux kernel >= 4.8 baseline; 5.15+ recommended; several advanced lessons require 6.x features (sched_ext needs 6.12, HID-BPF 6.3, TCX 6.6), and two cutting-edge lessons target 6.19/7.0-features.
  • CONFIG_DEBUG_INFO_BTF=y required by most lessons from lesson 2 onward (CO-RE type relocation); root privileges required everywhere except doc-only lessons.
  • Architectures: x86_64 and arm64 throughout; lesson 3 documents split fentry support (x86_64: 5.5, arm64: 6.0).
  • Hardware-specific lessons need an NVIDIA CUDA GPU (lesson 47), network interfaces for XDP lessons, or block devices for biopattern.

Latest Versions

No tagged releases; rolling main branch, last pushed 2026-07-26. Content frequency: multiple new lessons added in 2026 including TCX, egress pacer, exec-image inspector, energy monitor, TCP quarantine, and fsession-latency (kernel 7.0 features).

Alternatives

  • Official kernel samples (samples/bpf/) — authoritative but unpolished; minimal explanation.
  • libbpf-bootstrap — scaffold + a handful of examples; good once fundamentals are known.
  • BCC Python developer tutorial — legacy approach with runtime compilation; valuable for quick ad-hoc probing, deprecated as a first-learning path by the community.
  • bpftrace one-liners tutorial (also mirrored under this repo's src/bpftrace-tutorial) — fastest introduction but not a software-development path.
  • Brendan Gregg / learnEbpf.io style booksites — concept-first complements rather than code-first curricula.

Migration & Lock-in Risks

Pure documentation; no lock-in. Early lessons using the eunomia-bpf ecc/ecli toolchain introduce org-specific conventions, but all material maps cleanly back to plain libbpf; the project explicitly positions frameworks as interchangeable (similar process across BCC, libbpf, cilium/ebpf, eunomia-bpf).

Community Health

~4.25k GitHub stars, ~600 forks (August 2026), sustained commits through 2026. Issue/PR-driven additions welcome per README; discussion channels live in GitHub Discussions. The maintainer group is research-affiliated (OSDI 2025 publication), giving the tutorial unusually strong academic grounding.

Notes In This Folder

  • Architecture — curriculum structure, CO-RE pipeline, eunomia-bpf toolchain, compatibility-matrix mechanics.
  • Operations — environment setup, compiling and running lessons, debugging recipes, troubleshooting.
  • Security — privilege model, learning-environment isolation, dual-use lesson cautions, artifact supply chain.

Sources

  • Tutorial hub — full table of contents (retrieved via Defuddle, 2026-08-27)
  • Compatibility matrix — per-lesson kernel/config/architecture requirements (retrieved via Defuddle, 2026-08-27)
  • Lesson 0: Introduction — concepts, adoption context, learning plan (retrieved 2026-08-27)
  • Lesson 1: Hello World — eunomia-bpf toolchain workflow (source read via zread, 2026-08-27)
  • GitHub repository — stars/forks/license verified via GitHub API 2026-08-27
  • Further reading: papers — XRP (OSDI '22 Best Paper), Jitterbug, Electrode, BMC, hXDP curation
  • Organization overview cross-checked via GitHub API, 2026-08-27.

Questions

  • Which lessons have been ported to Rust-native implementations (libbpf-rs) end-to-end, and does the plan extend beyond lesson 12/37?
  • Does bpftime's GPU offload path change how lesson 47 (CUDA tracing) is taught long-term?
  • How quickly do kernel-version-gated lessons (52-fsession requiring 7.0) get usable baselines once distros ship those kernels?