Tutorial on ,
eBPF and WASM - Better Together
Learn how Inspektor Gadget pairs eBPF with WASM to process kernel events—and walk through the same idea yourself by implementing a minimal example.
Tutorials
Deep dives into DevOps and Server Side topics where theory blends with hands-on examples. You can try out commands from each tutorial in the attached remote playground, either from the browser or via SSH access from your local terminal — no extra setup required.
Tutorial on ,
Building an eBPF/XDP NAT-Based (Weighted) Round Robin Load Balancer from Scratch
In this lab, you’ll build a NAT-based eBPF/XDP load balancer from scratch and implement both round-robin and weighted round-robin backend selection. Along the way, you’ll learn how to manage state in eBPF maps and distribute traffic across backends based on simple and capacity-aware scheduling strategies.
Tutorial on ,
Building an eBPF/XDP NAT-Based (Weighted) Least Connection Load Balancer from Scratch
In this lab, you will extend the eBPF/XDP-based NAT load balancer implementation with the least-connections to a weighted least-connections algorithm that accounts for backend capacity.
Tutorial on ,
Accelerating Transparent Ingress Proxy with eBPF and Envoy
This lab teaches you how to use eBPF socket acceleration to speed up communication between processes on localhost and optimize a transparent Envoy proxy setup. You will implement techniques that bypass parts of the kernel networking stack, allowing data to be transferred more directly between sockets to improve throughput and reduce latency.
Tutorial on ,
Transparent Ingress Proxy with eBPF and Envoy
This lab shows how to use eBPF to transparently redirect inbound traffic through an Envoy proxy on the server side, without modifying the application or client. You’ll learn how eBPF can intercept and restore connections so the service remains unaware of the proxy in the network path.
Tutorial on ,
Transparent Egress Proxy with eBPF and Envoy
This lab teaches you how to use eBPF to transparently intercept and redirect a client's outgoing traffic to an Envoy proxy without requiring any changes to the application code. You will build a system that recovers original connection metadata via socket-level hooks and uses SO_MARK to prevent infinite routing loops, replacing traditional, complex iptables rules with a high-performance eBPF alternative.
Tutorial on ,
All The Ways To Loop and Iterate in eBPF
In this tutorial you will learn different ways to implement loops in eBPF, explaining how iteration evolved from manual loop unrolling to modern mechanisms like bounded loops, helper functions, and open-coded iterators. It walks through the limitations, kernel version requirements, and practical examples for each approach so you can choose the most appropriate looping method for your eBPF programs.
Tutorial on ,
Different Ways To Deliver Kernel Events from eBPF to User Space
In this tutorial, you’ll learn how eBPF applications send kernel events into user space using perf buffer and ring buffer, exploring their design, trade-offs, and performance implications. You’ll also learn how moderns solutions like Jibril handle high-throughput event delivery.
Tutorial on ,
Building an eBPF/XDP IP-in-IP Direct Server Return Load Balancer from Scratch
In this tutorial, you will learn how to build a IPIP DSR load balancer using eBPF/XDP, where backends from arbitrary networks send responses directly back to clients bypassing the load balancer.
Tutorial on ,
Building an eBPF/XDP L2 Direct Server Return Load Balancer from Scratch
In this tutorial, you will learn how to build an Layer 2 DSR load balancer using eBPF/XDP, where backends send responses directly back to clients bypassing the load balancer.
Tutorial on ,
Building an eBPF/XDP NAT-Based Layer 4 Load Balancer from Scratch
Learn how an eBPF/XDP-based NAT Layer 4 load balancer works by building one from scratch. We implement simple connection tracking, deterministic hashing, and IP/MAC rewriting with a small, easy-to-follow example.
Tutorial on ,
Building an eBPF-based Firewall with LPM Trie–Based IP Range Matching
Learn how to build an eBPF/XDP firewall that filters packets by IP ranges using BPF_MAP_TYPE_LPM_TRIE and longest-prefix matching.
Tutorial on ,
Hands-On with XDP: eBPF for High-Performance Networking
In this tutorial, you’ll learn the fundamentals of eBPF and XDP through example code that parses packets across different protocol layers, demonstrates how XDP actions work, and shows how these building blocks form the foundation for high-performance networking applications.
Tutorial on ,
Network Traffic Rate Limiting with eBPF/XDP
Learn how to implement a basic per-client ICMPv6 packet rate limiter using eBPF/XDP. This tutorial shows how to track client activity with eBPF maps and enforce limits directly in the kernel—without any user-space interaction.
Tutorial on ,
Why Does My eBPF Program Work on One Kernel but Fail on Another?
In this tutorial, we look at why eBPF programs can fail across kernel versions due to changes in structs, tracepoints, and function layouts. We look at examples of how these differences cause portability issues and how BPF CO-RE, BTF and vmlinux.h address them.
Tutorial on ,
Building Truly Portable eBPF Programs and BTFHub
In this tutorial, you’ll learn how to make your eBPF programs portable across kernels that lack built-in BTF support.
Tutorial on ,
eBPF Tracepoints, Kprobes, or Fprobes: Which One Should You Choose?
In this tutorial, we’ll look at how different eBPF tracing mechanisms work in practice by focusing on a single use case: capturing execve system call events. We’ll start with tracepoints, move on to raw tracepoints, and then cover kprobes and fprobes, showing how each attaches to the kernel and what data they expose. Along the way, we’ll compare their trade-offs in terms of stability, performance, and portability.
Tutorial on ,
eBPF Verifier: Why the Kernel Can Safely Run eBPF Programs
In this tutorial, you’ll learn why it is safe to run eBPF code in the kernel, some of its advantages compared to kernel modules, and why the verifier is the most crucial component of eBPF.
Tutorial on ,
Inspecting and Monitoring eBPF Applications
In this tutorial, you’ll learn how to inspect eBPF programs and maps loaded into the kernel with bpftool, gaining deeper visibility into how your eBPF application runs. We’ll also explore bpftop, a top-like interface that lets you monitor eBPF program activity in real time.
Tutorial on ,
Storing Data in eBPF: Your First eBPF Map
In this tutorial, you’ll learn how to store and update data inside the kernel, turning a simple eBPF Hello World program into one that tracks useful state. We’ll also briefly learn a few basics of bpftool, a handy CLI tool that will allow us to list and inspect our eBPF map.
Tutorial on ,
From Zero to Your First eBPF Program
In this first tutorial, you’ll run a pre-coded eBPF program and see it in action without writing any code yourself. We’ll walk through the important parts of the program so you understand how eBPF hooks and runs in the kernel. The goal is to get familiar with the workflow and core concepts before you start writing your own eBPF programs.
