Kernel Modules vs eBPF

Kernel Modules vs eBPF A workflow diagram generated by Archify. 01 / eBPF way EX / Traditional · kernel module Write eBPF · C / Rust · eBPF way Write eBPF C / Rust Runtime load · no reboot needed · eBPF way Runtime load no reboot needed Run verified · safe by design · eBPF way Run verified safe by design Kernel module · C code · Traditional · kernel module Kernel module C code Kernel compile · per-kernel rebuild · Traditional · kernel module Kernel compile per-kernel rebuild Instability risk · kernel panic possible · Traditional · kernel module Instability risk kernel panic possible Legend Authoring Build · load Risk

eBPF advantages

  • • Loads into the running kernel instantly
  • • The verifier guarantees safety

Kernel module burden

  • • Recompile for every kernel version
  • • One bug can take the whole system down