eBPF Learning Sandbox V1

eBPF Learning Sandbox V1

Explore the power of eBPF with the eBPF Learning Sandbox V1, a hands-on lab designed to introduce the core concepts and capabilities of this cutting-edge kernel technology. Developed as a foundational learning experience, this lab equips participants with the knowledge and skills to understand and leverage eBPF-based platforms like Cisco Hypershield and the open-source project Cilium for networking, security, and observability.

What You'll Learn:

• Understand eBPF Fundamentals: Gain insight into how eBPF extends kernel functionality, enabling programmable, high-performance operations.
• Hands-On Experience: Build, deploy, and test eBPF programs in a structured environment tailored for developers and IT professionals.
• Explore Real-World Use Cases: Learn how eBPF is used to enhance networking, container observability, and security through tools like Hypershield and Cilium.

Lab Overview:

This lab streamlines and builds upon the resources provided in the GitHub Tutorial for eBPF Development which provides participants with a step-by-step guide to creating eBPF programs. The Gihub Tutorial is a comprehensive tutorial that offers practical examples and real-world scenarios to bridge theoretical knowledge with hands-on expertise.  This Lab has streamlined a few of scenarios to enable users to run through some of the examples.  

Why It Matters:

eBPF has revolutionized how modern systems manage networking, observability, and security. As the backbone of platforms like Cisco Hypershield and Cilium, eBPF delivers unmatched performance and flexibility, making it essential for organizations aiming to secure and optimize their cloud-native and containerized environments.  Windows is expected to roll eBPF with native support in the near future. 

Who Should Explore This Lab:

• Developers and engineers looking to toch eBPF quickly and enhance their understanding.
• Security professionals seeking advanced tools for dynamic tracing and enforcement.
• IT teams managing modern infrastructure who want to adopt eBPF-based technologies.

Empower your organization with the knowledge and tools to harness the potential of eBPF. Join the eBPF Learning Sandbox V1 and take the first step toward mastering the future of networking and security.

eBPF (extended Berkeley Packet Filter) is a technology that allows you to run sandboxed programs in the Linux kernel without changing kernel source code or loading kernel modules. Here's a simple introduction to get you started:

Understand eBPF Basics:

•   eBPF programs are written in C and compiled into bytecode.
•   These programs can be attached to various hooks in the kernel, such as network events, system calls, and tracepoints.

Lab contains a Preconfigured Environment:

•   Installed necessary tools: `clang` (for compiling C to eBPF bytecode), `llvm`, and `bcc` (BPF Compiler Collection).

Write a Simple eBPF Program:

•  Review existing samples of code:

Compile the eBPF Program:

•   Use 'clang' to compile the C code into eBPF bytecode:

Load and Attach the eBPF Program:

•   Use tools like 'iproute2' or 'bpftool` to load and attach the eBPF program to a hook. For example, using `bpftool`:

Verify the Program is Running:

•   Check the kernel logs to see the output of your eBPF program:

This is a basic introduction to get you started with eBPF. There are many more advanced features and use cases, so I recommend exploring further documentation and tutorials in the eunomia github project as you become more comfortable with the basics.

This lab consists of ATC Gateway that hosts a preconfigured VM 

Linux VM

• Ubuntu VM
• Fedora VM

Pre Downloaded & provisioned

• Github assets