Ebpf GitHub Repositories (2026) · Open Source Tools

eBPF-based Security Observability and Runtime Enforcement

Web-based Traffic and Cybersecurity Network Traffic Monitoring

Explore Linux processes in 3D. A real-time process inspector powered by Rust, eBPF and Three.js.

Coroot is an open-source observability and APM tool with AI-powered Root Cause Analysis. It combines metrics, logs, traces, continuous profiling, and SLO-based alerting with predefined dashboards and inspections.

Cloud Native Runtime Security

eBPF-based Networking, Security, and Observability

The goal is to make it easier to configure your favorite Linux distribution as a router. Built with Rust and eBPF.

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.

eBPF-based autoinstrumentation of web applications and network metrics

A Kubernetes operator for network observability

Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

APM, Application Performance Monitoring System

eBPF-based observability for Linux kernel & Agent sandbox 🚀🚀

Continuous profiling for analysis of CPU and memory usage, down to the line number and throughout time. Saving infrastructure cost, improving performance, and increasing reliability.

eBPF distributed networking observability tool for Kubernetes

Per-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.

Open-source agent runtime — SSH-native isolation, eBPF egress policy, Kubernetes + LXC backends, GPU passthrough, MCP-native CLI