Cilium is a Kubernetes-native networking, observability, and security solution built on eBPF. It provides CNI plugin functionality with overlay/native routing modes, distributed load balancing (replacing kube-proxy), cluster mesh for multi-cluster connectivity, identity-based network policies (L3-L7), service mesh with mutual authentication, and observability via Hubble (flow metrics, DNS insights). The architecture features a modular design using the Hive dependency injection framework, with components including the cilium-agent daemon, operator for CRD management, CLI tools for management/debugging, and API servers for inter-component communication. The data plane leverages eBPF/XDP for high-performance packet processing, while the control plane integrates deeply with Kubernetes through client-go, controller-runtime, and custom resource definitions.
Apache SkyWalking is an open-source APM (Application Performance Monitoring) system designed for microservices, cloud-native, and container-based architectures. It provides distributed tracing, metrics aggregation, log analysis, and profiling capabilities (including eBPF, async-profiler, and JFR). The system features a modular, plugin-based architecture where receivers ingest telemetry data, analyzers process it, storage plugins persist it, and query services expose it via GraphQL, PromQL, LogQL, and TraceQL interfaces. Alarm mechanisms detect anomalies and trigger notifications through multiple channels. The codebase demonstrates strong engineering practices with clear separation of concerns, extensive use of interfaces and dependency injection, and reusable patterns like the module system, storage abstraction, and analysis listener framework.
Falco is a cloud-native runtime security daemon that monitors Linux system calls, Kubernetes audit logs, and plugin-supplied events in real time. It applies a flexible rule engine to detect anomalous behavior and generates alerts via multiple output channels (stdout, file, syslog, HTTP, program). The codebase is a monolithic C++ application with a modular internal architecture: a sequenced action pipeline (app/app.cpp) drives startup, configuration, plugin loading, rule compilation, event processing, and output dispatch. The rule engine (userspace/engine/) parses YAML rule definitions, resolves macros and filters, indexes rules by event type, and matches events efficiently. The output subsystem uses a thread-safe worker queue with a watchdog. Falco supports hot-reload via inotify file watching and a Unix socket control endpoint. It is deployed as a Helm chart on Kubernetes (DaemonSet/Deployment) and is packaged as DEB, RPM, and Docker images. The repository includes extensive unit tests (Google Test), end-to-end event generator tests, and CI/CD pipelines for building, testing, and publishing. External dependencies include falcosecurity/libs (sinsp), falcoctl, OpenSSL, cURL, yaml-cpp, and jemalloc. The architecture demonstrates strong engineering practices with clean abstractions (indexed_vector, atomic_signal_handler, yaml_helper) and composable action steps.
RustNet is a cross-platform, real-time network monitoring terminal UI application. It captures packets via libpcap (or platform-specific backends like PKTAP on macOS, ETW on Windows), performs deep packet inspection (DPI) for protocols including HTTP, HTTPS, DNS, SSH, QUIC, BitTorrent, and many others, and attributes each connection to the owning OS process using eBPF (Linux), lsof (macOS), IP Helper (Windows), or sockstat (FreeBSD). The architecture is a multi-crate Rust workspace: `rustnet-core` provides connection tracking, DPI analyzers, GeoIP/OUI lookup, and rate/RTT tracking; `rustnet-capture` wraps libpcap; `rustnet-host` implements process lookup via a unified `ProcessLookup` trait; `rustnet-sandbox` handles privilege dropping and sandboxing (Landlock, Seatbelt, Windows job objects). The main binary (`rustnet-monitor`) orchestrates capture, enrichment, and a ratatui-based TUI with tabs for Overview, Details, Activity, Graph, and Host. It supports PCAP/PCAPNG export with process metadata, JSONL event logging, Kubernetes pod attribution, and a rich theme system with multiple presets. The codebase is well-structured, extensively tested, and actively maintained with CI/CD for multiple platforms and packaging (DEB, RPM, DMG, MSI, Homebrew, Chocolatey).
Aya is a Rust framework for developing, loading, and managing eBPF (extended Berkeley Packet Filter) programs. It provides a pure-Rust alternative to libbpf and bcc, allowing developers to write eBPF programs in Rust without leaving the language ecosystem. The framework supports various eBPF program types (XDP, socket filters, tracepoints, kprobes, uprobes, LSM, etc.) and map types (arrays, hash maps, perf event arrays, ring buffers, etc.), with strong emphasis on type safety and developer experience. Aya implements BTF (BPF Type Format) support for compile-once-run-everywhere portability across kernel versions and provides procedural macros to reduce boilerplate when defining eBPF entities. The architecture consists of multiple crates separating userspace and kernel-space concerns, with extensive integration tests validating functionality against actual kernels.
This repository builds and maintains the `grafana/otel-lgtm` Docker image, an all-in-one OpenTelemetry backend for development, demo, and testing. It bundles Grafana, Prometheus, Tempo, Loki, Pyroscope, and the OpenTelemetry Collector into a single container, providing a complete observability stack with a single `docker run` command. The image supports optional eBPF-based auto-instrumentation (OBI) for zero-code traces and RED metrics, and can export telemetry to external vendors via OTLP. The architecture is a multi-stage Docker build that downloads and verifies each component using checksums or cosign signatures. The container entrypoint (`run-all.sh`) starts all services in parallel, waits for health checks, and handles graceful shutdown. The OpenTelemetry Collector configuration is dynamically extended based on environment variables (debug exporter, external endpoints, custom headers). The repository also includes example applications in Java, Go, Python, .NET, and Node.js that demonstrate OpenTelemetry instrumentation, along with acceptance tests (OATS) that validate traces, metrics, logs, and profiles. CI/CD is comprehensive: automated builds, linting (flint, hadolint, shellcheck, etc.), container scanning with Trivy, CodeQL analysis, and weekly scheduled releases with immutable version tags. Container images are signed with cosign and attested via GitHub Artifact Attestations. The repository is actively maintained with Renovate for dependency updates and a well-defined release process.
nettrace is a Linux network diagnostic tool based on eBPF that traces network packet lifecycle, performs fault diagnosis, and monitors network abnormalities. The architecture centers around a main CLI application (nettrace.c) that loads and attaches eBPF programs (primarily in src/progs/kprobe.c) to kernel functions and tracepoints. As packets traverse the network stack, eBPF programs capture event data sent to user space via perf buffers, where it's processed by analysis.c for diagnostic rule matching and formatted by output.c for display. Key features include basic packet tracing, diagnostic mode with automated problem identification, drop monitoring, socket tracking, and latency/RTT analysis. The tool relies on external dependencies like libbpf, libelf, and bpftool for eBPF program loading and compilation.
libbpf-rs is a Rust workspace providing safe, idiomatic bindings to the Linux libbpf C library for eBPF program development. It consists of two main crates: `libbpf-rs`, a high-level runtime library for loading, attaching, and managing eBPF programs and maps, and `libbpf-cargo`, a Cargo plugin that compiles eBPF C source files and generates Rust skeleton code with type-safe accessors and lifecycle management. The library supports a wide range of eBPF attachment types (kprobes, tracepoints, XDP, TC, netfilter, etc.), CO-RE (Compile-Once-Run-Everywhere) via BTF, and includes utilities like ring buffer and perf buffer helpers, a query interface for inspecting loaded kernel objects, and a linker for combining multiple BPF objects. Architecture is a workspace with library crates and numerous example applications (e.g., runqslower, tcp_ca, tproxy) demonstrating real-world usage. Entry points include `ObjectBuilder`, `SkeletonBuilder` (from libbpf-cargo), and generated skeleton APIs. The project relies on `libbpf-sys` for FFI, and examples use `clap` for CLI and `plain` for safe byte conversion. It is heavily tested with integration tests requiring root privileges.
picosnitch is a Linux daemon for per-executable network bandwidth monitoring using eBPF (CO-RE) and fanotify. It tracks which executables make network connections, records bytes sent/received, timestamps, and metadata (SHA256 hashes, optional VirusTotal and GeoIP lookups). The system provides real-time and historical views via multiple interfaces: a curses TUI (both live top and historical browser), a web UI, and a UNIX socket live feed. The daemon uses a multiprocess architecture with privilege-separated subprocesses for monitoring, event processing, database writes, notifications, and external API queries. It supports local SQLite storage and optional remote SQL (MariaDB/MySQL/PostgreSQL) for tamper-evident logging. The repository also includes a comprehensive comparative benchmark suite (bench/) that tests picosnitch against nine other network monitors across 24 scenarios, with a reusable ToolAdapter framework for running controlled experiments.
This repository implements OpenTelemetry eBPF Instrumentation (OBI), a production-grade observability agent that uses eBPF to automatically capture distributed traces, metrics, and logs from user-space applications without any code changes. It supports a wide range of protocols (HTTP/1.1, HTTP/2, gRPC, SQL, Redis, Kafka, MongoDB, AMQP, MQTT, DNS, and more) and multiple language runtimes (Go, Java, Python, Node.js, Ruby, .NET, Rust). The agent can run as a standalone binary, a Docker container, or an OpenTelemetry Collector receiver. Its architecture consists of eBPF programs (kprobes, uprobes, tracepoints, TC) that emit events to ring buffers, which are read by Go userspace tracers and processed through a pipeline of discovery, decoration, filtering, and export stages. Telemetry is exported via OTLP (gRPC/HTTP) or Prometheus, with optional Kubernetes metadata enrichment and network flow monitoring. The codebase is well-structured with clear separation of concerns, extensive integration tests, and several reusable generic components (message queues, pipeline runners, expiry caches, attribute filters). It is actively maintained with frequent commits and comprehensive CI/CD.
Tracee is a runtime security and observability tool that uses eBPF to trace system events and detect threats. It consists of multiple Go binaries: a main security agent (`tracee`) that loads eBPF programs, collects kernel events, and runs detection rules; a gRPC client (`traceectl`) for remote management; an event generator (`evt`) for stress testing; and a Kubernetes operator. The architecture is modular with a clear separation between eBPF event collection, event derivation and enrichment pipelines, data stores (process tree, container info, DNS cache, kernel symbols), a detection engine supporting both Go signatures and YAML-based rules using CEL expressions, and filtering/policy subsystems. The system operates as a daemon with HTTP/gRPC endpoints for metrics, health, and streaming event output, and integrates deeply with Kubernetes via CRDs and controllers. The codebase demonstrates strong engineering with clean abstractions (filter interfaces, data store registries, event derivation framework), reusable utility packages (bucketcache, changelog, string interning, fuzzy parsing), and comprehensive testing including unit, integration, and e2e tests. However, it exhibits technical drift in areas like multiple Go modules with `replace` directives, hardcoded kernel version checks in eBPF probe logic, legacy signature conversion code planned for removal, and some global mutable state. The eBPF C code is complex and kernel-version-sensitive, requiring ongoing maintenance. Overall, it is a well-crafted, production-grade security tool suitable for container and Kubernetes environments.
Parca is a continuous profiling platform that collects, stores, queries, and visualizes pprof profiles in real time. The Go backend ingests profiles via gRPC (both pprof and OpenTelemetry OTLP), normalizes them into Apache Arrow columnar format, and stores them in either FrostDB (default) or ClickHouse. It provides a rich gRPC+JSON API for querying profiles (flamegraph, table, source view, callgraph, pprof download), scraping Prometheus-style targets, managing debug information for symbolization, and sharing profiles via links. The TypeScript/React frontend delivers an interactive profiling UI with flamegraphs, tables, source views, metrics graphs, sandwich views, and comparison mode, all backed by efficient Arrow-based querying. The codebase demonstrates strong engineering with reusable patterns (generic caching, signed request abstraction, Arrow compaction), but carries some drift risk from dual storage backends, generated protobuf code, and a complex UI state layer built with multiple state management strategies.
KernelScript is a domain-specific language and compiler (OCaml) for developing eBPF-centric programs. The compiler translates a single `.ks` source file into multiple C outputs: idiomatic eBPF C code (for kernel execution via XDP, TC, kprobe, tracepoint, perf_event, struct_ops), userspace loader C code (managing maps, ring buffers, tail calls, and program lifetime), and optionally kernel module C code (for `@kfunc` functions). The compiler pipeline includes lexing, parsing, symbol table construction, type checking (including context-specific rules for eBPF program types), IR generation with control-flow and data-flow analysis, loop analysis (bound detection, bpf_loop optimization), tail-call detection and automatic progarry management, map assignment optimization, safety checking (null pointer, bounds, overflow), and multi-program optimization (map type changes, batching). It also supports BTF introspection for kernel type and kfunc extraction, a Python bridge, and a compile-time evaluator. The architecture is modular with pluggable context code generators per program type. The project includes an extensive test suite covering the full pipeline from parse to C output and specific features like perf_event attach, ring buffer dispatch, struct_ops, and multi-program scenario.
Procmon-for-Linux is a Linux port of Microsoft's Sysinternals Process Monitor. It captures and displays system call events in real-time using eBPF raw tracepoints. The architecture is a modular C++17 application with four layers: tracer (eBPF-based), storage (SQLite), display (ncurses TUI or headless), and configuration/CLI. The main entry point is src/procmon.cpp which initializes the eBPF programs, parses command-line arguments, and runs either an interactive terminal UI or a headless collection mode. Data flows from kernel eBPF programs to a user-space consumer via a cancellable message queue, then into an SQLite in-memory database, and finally to the display layer. The application supports filtering, sorting, searching, and exporting events. It depends on the SysinternalsEBPF library for eBPF loading, libncursesw6 for UI, libelf for symbol resolution, and SQLite3 for storage. The eBPF kernel modules are version-specific and support Linux kernels 4.17 through 5.6+. The project includes mock engines for testing and builds packages for Debian and RPM-based distributions. The codebase demonstrates strong software engineering practices: clear separation of concerns, use of design patterns (factory, strategy, observer via queues), thread-safe event handling, and comprehensive testing with Catch2. However, it has some technical drift risks due to reliance on specific kernel versions, an older version of Easylogging++, and a custom SysinternalsEBPF library that may change. The build process is well-documented with dev containers and CI pipelines.
psc is a CLI tool that uses eBPF iterators to scan processes and file descriptors with Google CEL for filtering. It provides container context for processes by integrating with Docker, containerd, CRI-O, and Podman runtimes. The architecture is modular with separate packages for BPF data unmarshaling, container management, CEL filtering, and output formatting (table/tree). Key strengths include its efficient kernel-level access via eBPF, expressive CEL-based filtering, and intelligent container context propagation to child processes.
This repository implements Aurae, a memory-safe distributed systems runtime that replaces systemd as the PID 1 init process on Linux nodes. It manages workloads (processes, containers, VMs) with cgroups v2 isolation, eBPF-based observability, and a gRPC API defined via protobuf. The system consists of three main binaries: auraed (daemon), auraescript (TypeScript scripting runtime), and aer (CLI). It also provides a partial Kubernetes CRI implementation and supports nested cells for multi-tenant isolation. The codebase is in early active development with many incomplete features and ignored tests, but demonstrates strong architectural patterns such as proc-macro-driven code generation, a reusable validation framework, and an eBPF abstraction layer. It is not production-ready.
Honey Potion is a compiler framework that translates a subset of the Elixir programming language into eBPF (extended Berkeley Packet Filter) programs, targeting both tracepoints and XDP. The system works as an Elixir library (published on Hex as `honey`) where users write eBPF logic in Elixir using macros like `@sec`, `defmap`, and `fuel`. At compile time, `__before_compile__` triggers a pipeline: static analysis, optimization (constant propagation, dead code elimination, type propagation), AST-to-C translation, boilerplate generation, and C compilation via `make`/`clang`/`llc`/`bpftool`. The generated C code includes a custom runtime with heap, tuple pool, and string pool implemented using BPF maps to overcome eBPF's stack and memory constraints. The repository includes 20+ example programs (system monitors, packet filters, data structure demos) and a comprehensive benchmark suite comparing hand-written C eBPF programs to Honey-generated ones, supporting a published research paper. Although classified as an application (a compiler library), the project has strong research characteristics with reproducible artifact scripts, optimizer variants, and performance comparisons.