a starter project develop ebpf in golang + devcontainer docker environment, works any env supporting docker, like apple silicon (m1/m2/m3...)
this is a starter project in which you can start developing ebpf
without any hassle.
it creates an ebpf ready environment using devcontainer
+docker
.
it even works in apple silicon
(m1/m2/m3...) macOS.
(actually I have only tested it in mac, will test it in other devices as well if I get the chance)
if you don't know what a devcontainer
is, it is a shareable, reusable & reproducible
development environment, which is supported by docker and won't pollute your system or VM.
so you don't need to create an ebpf development environment yourself,
and most importantly you can throw it away anytime.
devcontainer.json
and click on Create Dev Container and Mound Sources...
deny
it, currently I'm not sure why it's asking it and didn't want to share my information with it, so I denied it, and it worked flawlessly.Reopen in Container
when the container env has been loaded and get ready:
go generate ./ebpf
it will generate some go files from ./ebpf/counter.c
bpf file using bpf2go
tool. you can use these files in your ./cmd/main.go
. it would greatly simplify the userspace/kernel space communication. the generated files are already committed, so you won't feel any difference after executing this command.go run ./cmd/main.go
in jetbrains goland, in vscode you need to run sudo go run ./cmd/main.go
( currently I'm not sure why, but I'll try to fix it in the future.)./cmd/main.go
) and the other leg in kernel space (./ebpf/counter.c
)c
(or something similar to ) and put it into a file, in our case ./ebpf/counter.c
../ebpf/counter.c
) and then load it into the kernel, upon loading the kernel would first verify the compiled object and if it agrees with it then load it into kernelgo generate ./ebpf
+ ./ebpf/gen.go
we ask the bpf2go
to compile the ./ebpf/counter.c
and also generate some extra golang codes./cmd/main.go
userspace code we use those generated go codes and actually try to load the compiled version of ./ebpf/counter.c
into the kernel space../cmd/main.go
you can do some extra work as well
bpf maps
, the communication between userspace and kernel space can be achieved through these bpf maps
bpf2go
, check out their website ebpf-go.dev for more learning material on ebpf and go.bpf2go
to me