ebpf-go is a pure-Go library for reading, modifying, and loading eBPF programs and attaching them to various Linux kernel hooks.
The library addresses the need to work with eBPF programs from Go applications without heavy external dependencies. It provides utilities for loading, compiling, and debugging eBPF code, supporting both C-based eBPF programs compiled via the bpf2go tool and direct eBPF assembly written in Go. The library handles the full lifecycle: compiling C code to eBPF bytecode, auto-generating Go bindings, attaching programs to kernel hooks, and reading output from kernel-space data structures like perf buffers and ring buffers.
The tool suits projects that need to instrument or monitor Linux systems from Go applications, particularly long-running processes. It works across Linux on amd64 and arm64 architectures, with Windows support for the latest eBPF for Windows release. Developers should note the minimal external dependencies and the requirement for supported Go versions and Linux kernels at version 4.4 or later. The library includes specialized packages for different tasks: the asm package for writing eBPF assembly directly, bpf2go for embedding C-based eBPF programs, link for attaching to kernel hooks, perf and ringbuf for reading kernel output, features for probing kernel eBPF capabilities, btf for reading BPF Type Format metadata, and pin for working with pinned bpffs objects.
The project maintains active community engagement through GitHub Discussions and a Slack channel dedicated to user questions. Contributions are actively encouraged as a way to highlight eBPF use cases and shape the library's direction. The maintainers distinguish between support channels, directing new users and uncertain questions to Discussions rather than the bug tracker, and noting that the Slack channel's ephemeral history makes GitHub Discussions preferable for persistent problem-solving.
