The entire first page begs the question -- "what is eBPF?"
"My report "What is eBPF?" and in-depth book "Learning eBPF" are both available for download [0] from Isovalent or with your subscription to O'Reilly's learning platform. You can buy "Learning eBPF" from any good bookstore (support your local bookshop by ordering it there!)"
IIUC, you need to give contact info on that page to get the PDF. So this [1] might be a better starting point.
[0] https://isovalent.com/ebpf/
[1] https://ebpf.io/
It runs sandboxed kernel extensions? Or it's a VM? Something like that? The writing of the page itself doesn't inspire a lot of confidence, but then maybe it's just over my head.
Yes to both of those.
The kernel has a bunch of extension points that can run eBPF code in a VM. That code can make decisions for the kernel and/or track events.
eBPF code can do basically any calculation you want, but it can't have infinite loops.
It's loaded as bytecode, with a spec for how it's formatted and what the instructions do and what data structures are built in to the VM.
The main benefit is that it runs in the kernel, so it can be triggered very very often with minimal performance impact.
I clicked the first link so I got the gist but how many other people just give up and disengage with their post? Or click the link then just close the tab without reading further.