Heya 👋

I have been so heads-down with adding the support for Persistent Playgrounds that didn't get a chance to properly announce the release of the second batch of Teodor's eBPF programming series.

If you missed my previous email about this work, Teodor J. Podobnik is a renowned eBPF developer and technical writer, who chose iximiuz Labs to publish his hands-on eBPF learning materials.

Teodor's writing is crisp and clear, and while the tutorials are highly practical, they also come with the right amount of theory, and the materials are sprinkled with good looking technical diagrams.

Most importantly, since the materials are hosted on iximiuz Labs, you can follow the tutorials right in your browser, reproducing the commands and running the eBPF programs in the built-in terminal:

With the recent release, there is now 8 tutorials combined into two skill paths and augmented by one hands-on challenge (more challenges are coming soon, I believe):

• ​From Zero to Your First eBPF Program. The tutorial walks you through the important parts of an eBPF program so you can learn how eBPF hooks and runs in the kernel. The goal is to get familiar with the workflow and core concepts before you start writing your own eBPF programs.
• ​Storing Data in eBPF: Your First eBPF Map. In this tutorial, you'll learn how to store and update data inside the kernel, turning a simple eBPF Hello World program into one that tracks useful state.
• ​Inspecting and Monitoring eBPF Applications. Practice inspecting eBPF programs and maps loaded into the kernel with bpftool to gain deeper visibility into how your eBPF application runs.
• ​eBPF Verifier: Why the Kernel Can Safely Run eBPF Programs. Learn why it is safe to run eBPF code in the kernel, some of its advantages compared to kernel modules, and why the verifier is the most crucial component of eBPF.
• ​eBPF Tracepoints, Kprobes, or Fprobes: Which One Should You Choose? Explore how different eBPF tracing mechanisms work in practice by focusing on a single use case: capturing execve system call events.
• ​Building Truly Portable eBPF Programs and BTFHub. In this tutorial, you will see how to make eBPF programs portable across kernels that lack built-in BTF support.
• ​Why Does My eBPF Program Work on One Kernel but Fail on Another? Explore typical examples of how the difference in internal structs, tracepoints, and function layouts across kernel versions cause portability issues and how BPF CO-RE, BTF and vmlinux.h address them.
• ​Hands-On with XDP: eBPF for High-Performance Networking. Learn the fundamentals of eBPF and XDP through example code that parses network packets across different protocol layers, demonstrates how XDP actions work, and shows how these building blocks form the foundation for high-performance networking applications.

One of the hardest things to wrap you head around when starting with eBPF programming is to understand which tools and techniques work today in production environments and which are outdated or still experimental. Teodor's series solves this problem perfectly by giving you a clear learning path with a key focus on things that actually work. For more eBPF learning materials, follow Teodor J. Podobnik​ directly on Substack.

Happy learning!

Ivan

P.S. The Black Friday Sale is in full swing - the best chance to get iximiuz Labs Premium at a very special price.