The website uses cookies to optimize your user experience. Using this website grants us the permission to collect certain information essential to the provision of our services to you, but you may change the cookie settings within your browser any time you wish. Learn more
I agree
Text direction?

Go bindings for creating BPF programs.

Join GitHub today

GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.

Sign up



This repository provides go bindings for the bcc framework as well as low-level routines to load and use eBPF programs from .elf files.

Input and contributions are very welcome.

We recommend vendoring gobpf and pinning its version as the API is regularly changing following bcc and Linux updates and releases.


eBPF requires a recent Linux kernel. A good feature list can be found here: https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md


Install the latest released version of libbcc (either using a package manager or by building from source).


Building ELF Object Files

To build ELF object files for use with the elf package, you must use specific sections (SEC("...")). The following are currently supported:

  • kprobe/...
  • cgroup/skb
  • cgroup/sock
  • maps/...
  • socket...
  • tracepoint...
  • uprobe/...
  • uretprobe/...
  • xdp/...

Map definitions must correspond to bpf_map_def from the elf package. Otherwise, you will encounter an error like only one map with size 280 bytes allowed per section (check bpf_map_def).

The Cilium BPF docs contain helpful info for using clang/LLVM to compile programs into elf object files: https://cilium.readthedocs.io/en/latest/bpf/#llvm

See tests/dummy.c for a minimal dummy and https://github.com/weaveworks/tcptracer-bpf for a real world example.


Sample code can be found in the examples/ directory. Examples can be run as follows:

sudo -E go run examples/bcc/perf/perf.go


The semaphore.sh script can be used to run the tests in rkt stage1-kvm containers on different kernel versions. To run all tests on the host system, use go test as follows:

go test -tags integration -v ./...
Related Notes
Get a free MyMarkup account to save this article and view it later on any device.
Create account

End User License Agreement

Summary | 3 Annotations
go bindings for the bcc framework
2020/08/19 05:52
recommend vendoring gobpf and pinning its version
2020/08/19 05:53
2020/08/19 05:53