How eBPF Empowers Developers to Observe Inside the Linux Kernel in a Safe and Unintrusive Way

Episode notes

Daniel Finneran explores how eBPF has evolved far beyond its roots in packet filtering into a robust, safe way to extend the Linux kernel. He explains how the eBPF "verifier", the security guardrail, enables implementation of deep observability and networking without the risks of traditional kernel modules or the slow upstreaming process. He touches on tools like Tetragon that leverage eBPF for "front-foot" security enforcement, proactively intercepting threats such as buffer overflows before they execute, while providing visibility into file systems and drivers without intrusive instrumentation. Read a transcript of this interview: Newsletter:

• Architectural Patterns: Moving Beyond Cloud-Native to Local-First - Insights from Adam Wiggins72 / 100
• Increasing Users’ Data Agency: From BlueSky's AT Protocol to the Local-First Software Movement
• From MCP and Vibe Coding to Harness Engineering: How Did AI Native Engineering Evolve in One Year
• Requirements Analysis for Architects: A Conversation with Sonya Natanzon
• Chasing Efficient Java Development: From 1BRC to Developing Hardwood AI Natively