ecc docker usage
The only file you will need to write is:
after that, simply run this:
you will get a
package.json in your root dir. Just run:
to start it you can download
ecli tool from eunomia-bpf/releases, we have pre-build binaries for linux x86. Small and No dependencies, besides glibc and glibcxx. Or just run this:
The eBPF compiled code can run on different kernel versions(CO-RE). see: github.com/eunomia-bpf/eunomia-bpf for details.
Or you can do that without a container, which is listed below:
Use this as a github action, to compile online: see eunomia-bpf/ebpm-template). Only three steps
- use this repo as a github template: see creating-a-repository-from-a-template
- modify the
bootstrap.bpf.c, commit it and wait for the workflow to stop
- Run the
ecliwith remote url:
- We use the same c ebpf code as libbpf, so most libbpf ebpf c code can run without any modification.
- Supported ebpf program types:
fentry, we will add more types in the future.
If you want to use ring buffer to export events, you need to add
your_program.hto your repo, and define the export data type in it, the export data type should be a C
struct, for example:
The name and field types are not limited, but we will prefer use standard C types. If multiple struct exists in the header, we will use the first one. The feature is only enabled if we found a
BPF_MAP_TYPE_RINGBUFmap exists in the ebpf program.