Course content
- Module 1: Building the Lab Environment 30m
- Module 2: Core eBPF Fundamentals 45m
- Module 3: Building Modern eBPF With libbpf and CO RE 45m
- Module 4: Tracing and Observability with eBPF 30m
- Module 5: Kernel Tracing with BCC and libbpf 45m
- Module 6: User Tracing With eBPF 30m
- Module 7: Network Tracing with eBPF 45m
- Module 8: Improving Container Security with eBPF 45m
- Module 9: Where to Go Next with eBPF 15m
What is eBPF, and why does it matter?
eBPF (extended Berkeley Packet Filter) is a Linux kernel technology that allows you to run safe, sandboxed programs inside the kernel without modifying kernel source code or loading kernel modules. It lets you observe, trace, and control system behavior at runtime, with very low overhead.
For modern Linux systems, eBPF has become a foundational technology behind observability, networking, and security tools.
Many tools used today for performance analysis, tracing, container security, and networking are built on eBPF, even if users never interact with it directly.
Why sysadmins and DevOps should learn eBPF
As systems become more dynamic with containers, microservices, and ephemeral workloads, traditional monitoring and logging tools fall short. eBPF allows you to see what the system is actually doing, in real time, without restarting services or adding instrumentation.
For sysadmins and DevOps engineers, learning eBPF means:
- Debugging performance issues directly at the kernel level
- Tracing system calls, network traffic, and application behavior safely
- Understanding and trusting modern Linux observability and security tools
- Moving beyond black-box monitoring to real insight
This is a hands-on course
Most eBPF resources focus on theory or outdated workflows. This course takes a different approach.
This is a practical, scenario-driven eBPF course where you build tools, trace real workloads, and experiment on your own Linux system. You'll set up your own Linux system in a VM and practice the scenario explained in each module.
You won’t just learn how eBPF works, you’ll learn when and why to use it.
Who is this course for?
This course is designed for:
- Linux system administrators
- DevOps and SRE engineers
- Platform and infrastructure engineers
- Developers interested in performance and observability
- Security engineers exploring runtime detection
You do not need prior kernel development experience.
What will you learn?
- Build a complete local eBPF lab environment
- Understand core eBPF concepts and kernel constraints
- Write modern eBPF programs using libbpf and CO-RE
- Trace kernel and user space behavior
- Analyze network traffic with XDP and TC
- Apply eBPF concepts to container security
This course is available for free to Linux Handbook Pro members. With the Pro membership, you get access to all 15+ courses we have created so far. Lifetime membership is also available. Please reach out if you want lifetime membership.
About the author
Umair Khurshid
Developer, open source contributor, and relentless homelab experimenter.