eBPF Security Engineering with Python and Go

Reactive Publishing

As modern cloud-native environments and Linux infrastructures grow in complexity, traditional user-space security monitoring tools often struggle with performance overhead and limited visibility. Extended Berkeley Packet Filter (eBPF) changes this paradigm by running sandboxed programs directly inside the Linux kernel without requiring custom kernel modules or changing kernel source code.

eBPF Security Engineering with Python and Go provides a clear, technical roadmap for system architects, DevOps engineers, and security professionals looking to build low-overhead runtime threat detection and telemetry pipelines.

What You Will Learn:

• eBPF Core Concepts: Understand eBPF architecture, map types, verifier constraints, and helper functions.

• Kernel & User-Space Interaction: Write efficient kernel probes (kprobes), tracepoints, and user probes (uprobes) paired with user-space control loops.

• Dual-Language Tooling: Implement high-speed data extraction tools using Python (BCC) and production-grade binaries using Go (cilium/ebpf).

• Runtime Threat Detection: Intercept and analyze system calls, file access patterns, execution events, and network sockets in real time.

• Performance & Safety Optimization: Navigate verifier limitations, manage memory safety, and minimize system CPU/RAM overhead in high-throughput workloads.

Who This Book Is For:

This book is designed for software engineers, security operations (SecOps) engineers, and Linux system administrators who have a working knowledge of Linux command-line tools and basic proficiency in Python or Go. Prior experience with kernel development is not required.