Repolode
Submit
aliyun

aliyun/coolbpf

A C library and platform wrapping libbpf for compiling and loading eBPF programs, with remote compile and kernel-version backport support.

View on GitHub
Stars
292
Forks
44
Open issues
5
Last commit
9 hours ago

What is it?

coolbpf wraps the main functions of libbpf so developers can build kernel tracing and manipulation programs with less setup. It offers a local compile service with wrappers for BPF function calls, and a remote compile service that takes a bpf.c source file and returns a bpf.so object for the local application to load, so the user does not need to manage a compile environment.

The project also covers backporting newer kernel BPF features to older kernels using a kernel module, such as BPF support on 3.10 kernels and replacing perf buffers with ring buffers. It generates BTF automatically and provides bindings for Python, Go, C, and Rust. Building libcoolbpf requires elfutils-devel and gcc, while the eBPF tools additionally need clang and llvm.

The repository includes AgentSight, an eBPF-based observability tool for LLM agents that captures SSL/TLS traffic and process activity without code changes, and a set of kernel modules such as eNetSTL that provide extra kfuncs for XDP programs.

Key features

  • 01Local compile service with wrappers for BPF function calls.
  • 02Remote compile service that returns a bpf.so for local loading.
  • 03Kernel module backports such as BPF on 3.10 kernels and ring buffer in place of perf buffer.
  • 04Automatic BTF generation.
  • 05Language bindings for Python, Go, C, and Rust.
  • 06AgentSight observes LLM agent traffic and processes via eBPF without code changes.

Use cases

  • Building eBPF tracing tools without managing a local compile toolchain.
  • Running BPF programs on older kernels through kernel-module backports.
  • Observing AI agent network traffic and subprocess activity on Linux.

Quick start

  1. 1

    Install build dependencies (elfutils-devel, gcc)

  2. 2

    Install libcoolbpf from the project root

    ./install.sh
  3. 3

    Build the syscall example from the project root

    mkdir -p build && cd build && cmake -DBUILD_EXAMPLE=on .. && make

Things to know

  • Building the eBPF tools requires clang and llvm in addition to gcc and elfutils.
  • Some features such as kernel-version backport rely on loading a kernel module, which needs root access.
  • The README gives no explicit license-related or stability caveats beyond the listed dependencies.

In collections

OpenTelemetry & observability platforms

Topics

#ebpf#libbpf#kernel#observability#tracing#btf

FAQ

What is coolbpf?
A C library and platform wrapping libbpf for compiling and loading eBPF programs, with remote compile and kernel-version backport support. coolbpf wraps the main functions of libbpf so developers can build kernel tracing and manipulation programs with less setup. It offers a local compile service with wrappers for BPF function calls, and a remote compile service that takes a bpf.c source file and returns a bpf.so object for the local application to load, so the user does not need to manage a compile environment.
Is coolbpf free to use? What license does it have?
coolbpf is open source under the MIT license. Check the license terms before using it in commercial products.
Is coolbpf still maintained?
Actively maintained. The last commit to coolbpf was on Nov 7, 2026.
What can I use coolbpf for?
Building eBPF tracing tools without managing a local compile toolchain. Running BPF programs on older kernels through kernel-module backports. Observing AI agent network traffic and subprocess activity on Linux.
How do I install coolbpf?
Install build dependencies (elfutils-devel, gcc) Install libcoolbpf from the project root: ./install.sh Build the syscall example from the project root: mkdir -p build && cd build && cmake -DBUILD_EXAMPLE=on .. && make
Where can I get coolbpf?
The source code and installation instructions are on GitHub: https://github.com/aliyun/coolbpf

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects