I logged in just to say this: I love the sysdig engineering blog. Please don't stop writing blogposts. sysdig and clouflare are becoming my favorite engineering blogs.
While that's the original meaning of the acronym, it was generalized into a virtual machine, so it has come far from being able to just filter packets.
Just one place early on this page using the full words instead of the acronym would have done the job. Such a small change would make such an immense difference for outsiders.
This is very interesting. I dabbled with eBPF before using the more traditional bcc tools and the canned scripts, but this deep dive really gives a good perspective on the implementation underneath.
I wonder how long before we will see more critical parts of the kernel machinery being implemented completely in eBPF (like XDP currently). Fascinating technology!