eBPF and WASM - Better Together
Learn how Inspektor Gadget pairs eBPF with WASM to process kernel events—and walk through the same idea yourself by implementing a minimal example.

Tutorials, challenges, courses, skill paths, playgrounds, and more — search the whole library in one place.
Learn how Inspektor Gadget pairs eBPF with WASM to process kernel events—and walk through the same idea yourself by implementing a minimal example.

In this lab, you’ll build a NAT-based eBPF/XDP load balancer from scratch and implement both round-robin and weighted round-robin backend selection. Along the way, you’ll learn how to manage state in eBPF maps and distribute traffic across backends based on simple and capacity-aware scheduling strategies.

In this lab, you will extend the eBPF/XDP-based NAT load balancer implementation with the least-connections to a weighted least-connections algorithm that accounts for backend capacity.

This lab teaches you how to use eBPF socket acceleration to speed up communication between processes on localhost and optimize a transparent Envoy proxy setup. You will implement techniques that bypass parts of the kernel networking stack, allowing data to be transferred more directly between sockets to improve throughput and reduce latency.

In this challenge, you’ll debug and fix a deliberately “broken” eBPF program, then prove it’s running by identifying its program and map IDs. Along the way, you’ll explore bpftool, check which helpers are supported, and dig into details like the UID of the loader. Finally, you’ll test your knowledge of eBPF maps by recalling the flag that only inserts a key if it doesn’t already exist.
A detailed walkthrough of Kubescape Nodeagent, observing a fileless (pseudo) attack all the way from the Kernel to the Alert.

A hands-on guide to building a minimal service mesh using eBPF and Envoy, focusing on transparent traffic interception and the core mechanics behind policy, observability, and encryption.
A hands-on learning path that teaches how to use eBPF and XDP for high-performance, in-kernel packet processing, from protocol parsing to advanced use cases like firewalling, rate limiting, and load balancing.
In this learning path, you’ll go from comparing different tracing program types — tracepoints, raw tracepoints, kprobes, and fprobes — to writing portable eBPF programs that work reliably across environments. You’ll also understand the role of BTF and learn how to make your eBPF code portable even when BTF isn’t available on the target system.
Learn eBPF from the ground up — from writing and running your first program, to storing data in eBPF maps, inspecting and monitoring kernel activity using bpftool and bpftop, and understanding how the verifier ensures safe eBPF execution. Finish with a hands-on challenge to put your new skills to the test.