The State of eBPF: Exploring eBPF Evolution, Use Cases, Challenges and Future
March 12, 2024

Thomas Graf
eBPF Foundation

eBPF is a technology that allows users to run custom programs inside the Linux kernel, which changes the behavior of the kernel and makes execution up to 10x faster(link is external) and more efficient for key parts of what makes our computing lives work. That includes observability, which enables engineers to see where a system is going wrong and find fixes faster; networking, which involves everything from how fast emails move to how fast computation occurs; to security, which keeps our digital lives and infrastructure safer from cyber threats.

The eBPF Foundation has released a publication titled The State of eBPF(link is external), a qualitative research report that covers the evolution of eBPF, the revolution it created, what's being built with it today, challenges, and where the technology is heading. The report provides valuable insight into how to make the most of what eBPF offers currently, plans for the future, and how stakeholders can get involved with the project to help eBPF continue to improve. Read on for key insights from the report to learn more about eBPF and how it can impact the way you develop applications.


About eBPF

The innovation of eBPF means companies need less hardware to achieve better performance and they consume less power to perform the same functionality. That makes operations more cost efficient, energy efficient, and sustainable, which is increasingly required to meet shareholder, consumer and community expectations.

eBPF was Linux only until recently. In 2021, Microsoft created the eBPF for Windows project to allow eBPF programs to run on top of the Windows OS. This laid the groundwork for eBPF to be standardized as an industry-wide infrastructure language. With a unified underlying infrastructure, companies can innovate however they want on top without risk of becoming locked in to one OS or the other.

This lack of vendor lock-in — from the browser to the database to the cloud — has historically spurred increased innovation, competition in terms of cost and performance, and is a bedrock tenet of the open source ethos that drives both Linux and eBPF.

eBPF is like a virtual machine in the Linux kernel. With eBPF, a developer writes eBPF instructions to run small specialized programs. They go to an eBPF "verifier," which checks to make sure the program is safe to add to the kernel and won't introduce bugs or crash the kernel. The program is JIT-compiled into machine code that gets executed and attached to event targets, which means the program is activated by an event, such as a file opening.

eBPF Adoption

For more than five years, eBPF has been operating on millions of devices and servers worldwide. Most people are already impacted by what companies do with it — and they probably don't know it.

Many of the US hyperscalers — Meta, Google, Netflix — use eBPF in production. Every Android phone uses eBPF to monitor traffic. Every single packet that goes in and out of a Facebook datacenter is touched by eBPF. Companies in myriad industries, including software, cloud services, financial services, telco, media and entertainment, ecommerce, consulting, and security, are increasingly using eBPF technology to do more, faster, saving time and money and increasing performance. 

Of course hyperscalers and big companies have what most companies do not have: teams of software engineers. To spread eBPF into more enterprises, open source software projects arose to make the technology consumable out-of-the box.

Here's a breakdown of three major use cases, for eBPF in production:

eBPF Use Case 1: Observability

For many companies, observability is where eBPF first took off and has had its biggest impact. With greater observability in distributed systems that might involve tens, hundreds, or thousands of servers, companies can more easily and fully know where the system is spending its time. They can see for example, where bottlenecks are occurring, how fast CPUs are working, where they're spinning cycles, and where to find, more quickly, what piece of code may be malfunctioning. By attaching eBPF programs to events like a file opening, users get metrics that provide amazing visibility into what's happening in the system.

eBPF Use Case 2: Networking

Networking is a great example of how eBPF adds speed and performance. Many parts of the Linux networking stack were written decades ago when IPs and port ranges could be tracked on spreadsheets rather than changing with every container. eBPF enables programmers to rewrite the networking stack, only leverage the needed parts, or skip it completely to save time and processing power. By bypassing things that are not needed or rewriting functionality based on new methods of building software, networking performance dramatically improves.

eBPF Use Case 3: Security

eBPF enables enhanced observability making it easier to spot and prevent security attacks, including those within the kernel as well as throughout Kubernetes and cloud native environments. eBPF also pushes security enforcement policies into distributed environments so they get implemented in real time. If a vulnerability occurs in the kernel, for instance, fast fixes can occur via eBPF without altering the kernel code, allowing for security updates on the fly.

While eBPF is already widely deployed, it is still at the beginning of the large wave of innovation it will unlock.

No doubt, eBPF will become an essential layer in the new cloud native infrastructure stack, impacting the observability, performance, reliability, networking, and security of all applications. Platform engineers will cobble together eBPF-powered infrastructure building blocks to create platforms that developers then deploy software on. These platforms will add business logic to the mix, replacing aging Linux kernel internals that cannot keep up with today's digital and, increasingly, cloud native world. 

Thomas Graf is Governing Board Chair of the eBPF Foundation
Share this

Industry News

May 29, 2025

Sauce Labs announced the general availability of iOS 18 testing on its Virtual Device Cloud (VDC).

May 29, 2025

Infragistics announced the launch of Infragistics Ultimate 25.1, the company's flagship UX and UI product.

May 29, 2025

CIQ announced the creation of its Open Source Program Office (OSPO).

May 28, 2025

Check Point® Software Technologies Ltd.(link is external) announced the launch of its next generation Quantum(link is external) Smart-1 Management Appliances, delivering 2X increase in managed gateways and up to 70% higher log rate, with AI-powered security tools designed to meet the demands of hybrid enterprises.

May 28, 2025

Salesforce and Informatica have entered into an agreement for Salesforce to acquire Informatica.

May 28, 2025

Red Hat and Google Cloud announced an expanded collaboration to advance AI for enterprise applications by uniting Red Hat’s open source technologies with Google Cloud’s purpose-built infrastructure and Google’s family of open models, Gemma.

May 28, 2025

Mirantis announced Mirantis k0rdent Enterprise and Mirantis k0rdent Virtualization, unifying infrastructure for AI, containerized, and VM-based workloads through a Kubernetes-native model, streamlining operations for high-performance AI pipelines, modern microservices, and legacy applications alike.

May 28, 2025

Snyk launched the Snyk AI Trust Platform, an AI-native agentic platform specifically built to secure and govern software development in the AI Era.

May 28, 2025

Bit Cloud announced the general availability of Hope AI, its new AI-powered development agent that enables professional developers and organizations to build, share, deploy, and maintain complex applications using natural language prompts, specifications and design files.

May 27, 2025

AI-fueled attacks and hyperconnected IT environments have made threat exposure one of the most urgent cybersecurity challenges facing enterprises today. In response, Check Point® Software Technologies Ltd.(link is external) announced a definitive agreement to acquire Veriti Cybersecurity, the first fully automated, multi-vendor pre-emptive threat exposure and mitigation platform.

May 27, 2025

LambdaTest announced the launch of its Automation MCP Server, a solution designed to simplify and accelerate the process of triaging test failures.

May 27, 2025

DefectDojo announced the launch of their next-gen Security Operations Center (SOC) capabilities for DefectDojo Pro, which provides both SOC and AppSec professionals a unified platform for noise reduction and prioritization of SOC alerts and AppSec findings.

May 22, 2025

Red Hat announced enhanced features to manage Red Hat Enterprise Linux.