eBPF is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.
It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.
eBPF-based Networking, Security, and Observability
APM, Application Performance Monitoring System
The container platform tailored for Kubernetes multi-cloud, datacenter, and edge management ⎈ 🖥 ☁️
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
Cloud Native Runtime Security
Web-based Traffic and Cybersecurity Network Traffic Monitoring
Coroot is an open-source observability and APM tool with AI-powered Root Cause Analysis. It combines metrics, logs, traces, continuous profiling, and SLO-based alerting with predefined dashboards and inspections.
Cloud native networking and network security
Instant Kubernetes-Native Application Observability
eBPF-based Linux high-performance transparent proxy solution.
Per-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
eBPF-based Security Observability and Runtime Enforcement
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
Continuous profiling for analysis of CPU and memory usage, down to the line number and throughout time. Saving infrastructure cost, improving performance, and increasing reliability.
Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.
Linux Runtime Security and Forensics using eBPF
Created by Alexei Starovoitov, Daniel Borkmann
Released 2014