In this challenge, you’ll tackle the most fundamental eBPF tasks. We’ve taught you the basics — now it’s your turn to put them into practice.

Before you get going, build and run the eBPF application. You’ll find it in the ebpf-hello-world/challenge
directory — and yes, we’ve slipped in a verifier error on purpose just to keep you on your toes. Your mission - figure out why it fails and fix it.
Hint 1 💡
It’s an easy one — try building and running the "broken" program and you’ll understand.
Now that your program is running, let’s inspect it.
Keep it running, then open a second Term 2
terminal on the right (click the +
at the top).
Every eBPF program gets a unique ID for tracking. Can you find the ID of the program you just started?
Hint 1 💡
sudo bpftool --help
is your friend 😉
Sometimes, knowing which user loaded an eBPF program is useful for accountability and security.
Find the User Identifier (UID) that loaded the eBPF program of type tracepoint
with name challenge
.
We also learned that not all eBPF programs support every eBPF helper function.
Can you find whether an eBPF program of type tracepoint
support the bpf_override_return()
helper? (Answer with yes
or no
)
Hint 1 💡
This one is up to you — either the eBPF documentation or sudo bpftool --help
will point you in the right direction 😉
What about eBPF maps - can you find the ID of the exec_count
eBPF map that was defined and loaded in your eBPF program?
Hint 1 💡
sudo bpftool --help
is your friend 😉
And for the last, slightly harder question before I let you go...
Can you recall what eBPF map flag should one provide to the bpf_map_update_elem()
that adds the entry only if the key doesn't exist yet.
Hint 1 💡
Feel free to check the eBPF docs — you don’t need to know everything by heart, just how to find it 😉
Level up your Server Side game — Join 14,000 engineers who receive insightful learning materials straight to their inbox