A book-in-progress about the Linux kernel and its insides.
Repository Index
47,133 repositories indexed
1–20 of 20 · Most stars
Application Kernel for Containers
Mirror of https://gitlab.redox-os.org/redox-os/redox
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
syzkaller is an unsupervised coverage-guided kernel fuzzer
Packet, where are you? -- eBPF-based Linux kernel networking debugger
MirageOS is a library operating system that constructs unikernels
🕵️♂️ TUI for sniffing network traffic using eBPF on Linux
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
ebpfkit is a rootkit powered by eBPF
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
Omarchy Mobile: native Omarchy on mobile phones. Arch Linux ARM, Hyprland and Omarchy on a mainline kernel (work in progress)
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
OPAL boot and runtime firmware for POWER
🐧 Security-focused Linux distribution with 140+ tools, custom kernel 6.17.13, AI assistant | 5 editions | Cloud, AI/ML, Automotive, Hardware hacking
Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage maps and enforces role-based policies on file access, network operations, and process execution.
Sample project demonstrating how to use eBPF to encap/decap packets with an MPLS label.
An example of writing an external, simple Linux kernel module, in V.
A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.
eBPF system monitor that runs inside the kernel. Sub-millisecond samples, zero allocations, faster than top.