Co-presented with Chris Tarazi at FOSDEM 2026 in the eBPF Developer Room.
Abstract
eBPF programs often behave differently than developers expect, not because of incorrect logic, but because of subtle behaviours of the hookpoints themselves.
In this talk, we focus on a small set of high-impact, commonly misunderstood attachment types:
- kprobes/fentry
- tracepoints
- uprobes
We expose the internal kernel mechanics that cause surprising edge cases, explain why they occur, and show how to work around them.