When you start writing your first eBPF program, there are many moving parts to get right — where to write the program, how to load it into the kernel, where to attach it, and how to debug it, just to name a few. Without understanding these basics, it’s easy to feel lost as things become more complex.

In this tutorial, you’ll run a pre-written eBPF program and explore how it’s loaded and hooked into the kernel. By the end, you’ll have a clear understanding of the key components that make eBPF work — giving you the confidence to start writing your own programs.

Writing and loading a “Hello, World!” eBPF program might seem easy, but that can only take you so far. At some point, you’ll need a way to store information inside the kernel — to track events, maintain counters, or share state between eBPF programs and user space. That’s exactly what eBPF maps are for.

In this tutorial, you’ll learn how to use eBPF maps to store and manage data inside the kernel, and how to inspect them with bpftool.

As you start building eBPF programs, it’s easy to lose track of what’s actually running inside the kernel. You might have multiple programs and maps loaded, but without the right tools, understanding their state and behavior can feel like a black box.

In this tutorial, you’ll get hands-on with two powerful tools — bpftool and bpftop that let you inspect, analyze, and monitor your eBPF programs, giving you full visibility into how they operate and perform inside the kernel.

Running code inside the Linux kernel may sound risky — a single bug could crash the entire system. Yet eBPF manages to do this safely, allowing developers to extend kernel functionality without compromising stability. But how is that possible?

In this tutorial, you’ll learn how the verifier keeps eBPF safe, why it’s such a critical part of the ecosystem, and how to handle different verification errors.

Last but not least — put your knowledge to the test and take it into the wild.