“By the end, attendees will understand:

How eBPF programs attach to hooks in the Linux kernel.
What the verifier and maps do, and how eBPF programs interact with userspace.
How to use bpftrace, bpftool, and common tracing tools to inspect a running system.
How the workflow progresses from ready-made tools to a small compiled eBPF program.
Where to go next to keep experimenting.”