[zrouga]

Thanks! eBPF has been a big win for us. Once you get past the verifier constraints, it really changes how you think about observability — pushing filtering and classification into the kernel reduces noise and makes the data much more actionable.

Workflow-wise, iteration is slower at first (compile → load → fail verifier ), but once the patterns are in place it actually simplifies things a lot. The ability to run this safely in production without noticeable overhead has been the biggest impact.