A Beginner's Guide to eBPF in Rust — from kprobes to a working agent

A few months ago I decided to learn eBPF. Almost every beginner resource I found was C-centric — bcc, libbpf, kernel headers, Makefiles that break. Meanwhile I kept hearing that Rust, via the Aya framework, is one of the nicest ways to write eBPF today: both the kernel-side programs and the userspace loader in one language, one Cargo project, no C toolchain.

What I couldn't find was a structured path from zero. So I built one, and I'm sharing it: A Beginner's Guide to eBPF in Rust — 8 chapters, each with runnable code.

What eBPF is, in two sentences

eBPF lets you run small, sandboxed programs inside the Linux kernel — triggered by events like a process starting, a network packet arriving, or a function being called. The kernel's verifier checks your program before it runs, which makes it safe to attach to a production machine: you can trace, filter, and observe at a level that used to require writing kernel modules.

What the guide covers

1. Getting started with Aya — project setup, what the verifier actually checks, loading your first program
2. Kprobes — run code when any kernel function is called
3. XDP — process network packets before they even reach the network stack (this is what powers fast firewalls)
4. Traffic control (TC) — packet processing on the egress side
5. Tracepoints and uprobes — stable kernel hooks, plus hooking into userspace functions
6. eBPF maps — shared state between kernel and userspace
7. Security & observability — combining hooks to detect what's happening on a system
8. Capstone — a small agent that combines everything: it watches process executions and network events and reports them to userspace in real time

Each chapter is a standalone Cargo project in the repo, so you can cargo build and try things as you read.

Why Rust + Aya?

• One toolchain: cargo handles both sides of the program; no separate C build system
• Compile-time checks on kernel code: the Rust compiler catches a lot before the verifier ever sees your program
• Aya generates the bindings: loading programs and reading maps is typed, safe Rust code

You do still meet the verifier — and that's a feature. Learning to read verifier errors is half of learning eBPF, and the guide spends time on it instead of waving it away.

Try it

• 📖 Read the book online: https://amghazanfari.github.io/ebpf-beginner/
• 💻 Source code: https://github.com/amghazanfari/ebpf-beginner

If you spot anything confusing or wrong, please open an issue — I'd genuinely like to keep improving it. And if you've been meaning to get into eBPF but kept bouncing off the C-heavy tutorials, I'd love to hear whether this gets you unstuck.