Hello 👋

eBPF is one of the topics many of you have asked me to cover on iximiuz Labs - but until now, I've lacked both the time and enough production experience with the technology.

That's why I couldn't be happier to announce that Teodor J. Podobnik, a renowned eBPF developer and technical writer, chose iximiuz Labs to host his new eBPF programming series.

When I was getting started with eBPF myself (a few years ago), most of the available materials would:

• Assume deep prior knowledge of Linux internals
• Overly use terminology that only insiders could be fluent in
• Feature examples that often wouldn't compile on my version of Linux

And this is precisely what makes Teodor's writing stand out - it's clear, gradual, beginner-friendly, and, because it's now hosted on the Labs, the examples always work.

Without further ado, I'll hand it over to Teodor.

The Linux kernel was always seen as something only highly skilled engineers could work with. Many developers think of it as a black box - something that just runs beneath your applications and can't really be changed or optimized.

But as we are getting closer to 2026, that view is shifting. eBPF is making kernel-level programming accessible to more engineers, and it’s proving valuable for companies that use it.

Just two weeks ago, Cloudflare used eBPF and XDP to mitigate the largest-ever DDoS attack, which peaked at 22.2 Tbps.

Meta shared that their tool Strobelight, built on eBPF, helped them reduce CPU cycles and server demand by up to 20% - a huge cost saving at their scale.

Netflix uses eBPF for application traffic observability. Compared to their previous solutions, it reduced latency and improved throughput while keeping full visibility into network activity.

Datadog had issues with their old Netlink-based monitoring, which caused high CPU usage and data loss. Replacing it with eBPF cut CPU usage by about 35% and made network monitoring faster and more reliable.

And it's not just large companies benefiting from eBPF. Projects like StepSecurity use it to protect CI/CD pipelines from runtime attacks, while Polar Signals - founded by the co-creator of Prometheus - uses eBPF to continuously profile production systems with minimal overhead.

Still, for many engineers, eBPF can seem like something complex or out of reach. I've been there too. Four years ago, I had no idea where to start - and there wasn't really a structured way to learn this technology. I kept asking myself: where do I even begin?

With this in mind, the idea of eBPFChirp and eBPF Coding Labs was born. While eBPFChirp is your go-to newsletter for weekly, free insights and stories from eBPF experts about eBPF, Labs builds on that foundation by offering a hands-on, interactive learning experience.

This week, we're releasing the eBPF Beginner Skill Path - a structured, hands-on set of labs where you'll learn to:

• 🐣 Run your first "Hello, eBPF!" program - understand what happens when your code runs inside the kernel, and how eBPF loaders like libbpf make it possible.
• 🗂️ Store and share data with eBPF maps - use maps to track events, maintain counter metrics, and exchange data between kernel and user space programs.
• 🔍 Inspect and monitor eBPF applications - use tools like bpftool and bpftop to see what's running in your kernel, measure performance, and debug issues.
• 🧩 Understand the eBPF verifier - see how the kernel ensures your code is safe to run, and learn to interpret and fix verifier errors.
• 🏁 Test your knowledge in the eBPF Challenge - apply everything you've learned in a fun, beginner-friendly challenge designed to strengthen your fundamentals.

Practical, focused, and rooted in fundamentals - this path will give you the confidence to start building your own eBPF tools and prepare you for the more advanced labs we'll soon release on iximiuz Labs.

Happy 🐝-ing!

Check out the new skill path and don't forget to subscribe to Teodor's eBPF newsletter.

Cheers,

Ivan