CNCF-hosted Co-located Events Europe 2024

A lot of eBPF existing documentation focuses on instrumenting the Linux Kernel, or native applications which have standard ELF symbol tables and do their own memory management. But, what about using eBPF to instrument applications that compile to native code, but are managed by a runtime of some kind? For example, can we use eBPF to instrument applications written in Go or Java? This talk focuses on discussing approaches to instrumenting applications which have non-standard symbol tables, don’t have static symbol tables, can dynamically recompile parts of their code, have reference moving memory managers (GCs), and can grow/shrink the stack between ‘uprobe’ and ‘uretprobe’. We’ll go through various learnings and failures we had while working on application instrumentation with eBPF, trying to instrument natively compiled applications running with managed runtimes.