eBPF Explained: How Code Runs Inside the Linux Kernel, and Why Cilium Is Built on It

What eBPF actually is, why the verifier means it can't crash your kernel, hooks and maps in plain words, two runnable examples with bpftrace and libbpf, and how Cilium turns all of it into a CNI.

August 2026