#

eBPF

eBPF is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.

It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.

Here are 30 public repositories matching this topic...

yeet-src / httpinspect

top, but for the HTTP endpoints on your host — a live dashboard of the most active plaintext HTTP endpoints, right in the terminal.

javascript http interactive showcase tui ebpf observability

Updated Sep 23, 2026
JavaScript

CycodeLabs / cimon-action

Runtime Security Solution for your CI/CD Pipeline

linux security hardening security-hardening ebpf cicd github-actions supply-chain-security

Updated Sep 20, 2026
JavaScript

yeet-src / usbsnoop

Live, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no hardware sniffer. CO-RE portable.

linux usb reverse-engineering showcase tracing ebpf observability bpf yeet libbpf co-re usb-sniffer

Updated Aug 10, 2026
JavaScript

yeet-src / airtop

htop for the airwaves — a live 802.11 (Wi-Fi) RF dashboard in your terminal

terminal wifi showcase tui network-monitoring ebpf rf bpf 802-11

Updated Aug 31, 2026
JavaScript

binw666 / learning-ebpf-translation

本项目翻译自 Liz Rice 的 Learning eBPF，这是一本比较系统的 eBPF 入门书籍。

translation book ebpf

Updated Sep 6, 2024
JavaScript

yeet-src / agent-lock

Confine an AI coding agent to one directory with a BPF-LSM program, and watch every escape it tries.

linux security sandbox showcase ebpf enforcement ai-agents lsm yeet llm-tools agent-security bpf-lsm

Updated Aug 20, 2026
JavaScript

cn0xroot / CC-Monitor

Claude Code Monitor : Monitor & audit every action Claude Code takes on your computer.

macos linux security log-analysis ai ebpf claude edr anthropic claude-ai anthropic-claude claude-code anthropics vibdecoding claude-code-plugin log-audit log-auditing cc-monitor ai-edr

Updated Sep 24, 2026
JavaScript

yeet-src / redissnoop

Live terminal Redis traffic profiler built on eBPF. Ranks key patterns, flags footguns, reads TLS.

linux tls redis performance networking showcase ebpf resp redis-monitoring observability kprobes yeet uprobes key-patterns

Updated Aug 21, 2026
JavaScript

garnet-org / action

Kernel-level execution records for GitHub Actions

security verification ebpf observability github-actions supply-chain-security agentic-workflow

Updated Sep 24, 2026
JavaScript

yeet-src / httpwatch

http requests served to your browser. Every plaintext HTTP request crossing the box — decoded off the wire by eBPF and rendered live in native browser components. No proxy, no sidecar, no app changes; one Docker command.

http gui browser web showcase ebpf yeet

Updated Aug 11, 2026
JavaScript

yeet-src / sqlitefeed

tail -f for SQLite. Every statement any process on the box runs against libsqlite3 — the SQL (syntax-highlighted), the values bound to its ? placeholders, the per-step latency and result code — decoded and streamed live to your terminal. No cooperation from the traced apps, no recompile, no PRAGMA.

sqlite showcase sqlite3 ebpf uprobe

Updated Aug 26, 2026
JavaScript

yeet-src / exectop

Scoped process-launch monitor for Linux: every program one app starts, folded, with the unusual on top

linux cli containers supply-chain showcase tui ebpf build-tools exec observability tracepoints process-monitoring yeet

Updated Sep 3, 2026
JavaScript

qweralfredo / ebpf-design

eBPF made simple - 🤓 Learn or Die 💀

ebpf reactflow

Updated Oct 26, 2025
JavaScript

yeet-src / agent-jail

Confine an AI coding agent (oh-my-pi/omp) to one directory with Landlock, and watch it live over eBPF. Experimental.

security sandbox showcase ebpf ai-agents yeet landlock llm-tools oh-my-pi

Updated Aug 10, 2026
JavaScript

yeet-src / container-traffic

Live per-container HTTP dashboard read from the kernel with eBPF. Rate, errors, latency. No sidecar, no app changes.

linux docker http kernel containers showcase tui cgroups ebpf observability kprobes yeet uprobes http-monitoring red-method

Updated Aug 10, 2026
JavaScript

devops-stack / ring-0

Real-time Linux Kernel Visualization

linux ai kernel linux-kernel ebpf observability arhitecture cyberpunks

Updated Sep 21, 2026
JavaScript

ShinigamiKiko / wolfee-watcher

k8s runtime security monitor

runtime ebpf cis-benchmark runtime-security kubernetes-security tracee fstec syscall-tracer

Updated Sep 19, 2026
JavaScript

rgolangh / gnome-shell-extension-camera-indicator

A Gnome Shell extension to indicate if a camera device is in use

camera gnome dbus ebpf

Updated Oct 2, 2023
JavaScript

yeet-src / dialout

Every outbound TCP connection, captured in-kernel and grouped by the process that dialed it. Flags public egress.

linux security networking kernel tcp showcase tracing ebpf observability bpf yeet egress co-re fexit

Updated Jul 10, 2026
JavaScript

yeet-src / grpcsnoop

tcpdump for gRPC. Decodes protobuf messages between services live, from the kernel. Plaintext only.

linux debugging networking kernel protobuf containers http2 grpc showcase tracing tc ebpf tcx observability bpf yeet

Updated Aug 10, 2026
JavaScript

Created by Alexei Starovoitov, Daniel Borkmann

Released 2014

Followers: 262 followers
Website: github.com/topics/ebpf
Wikipedia: Wikipedia