eBPF Looks Illegal: running your code inside the Linux kernel

A visual walkthrough of Linux eBPF. It goes through the basic pipeline: write a small C program, compile it with clang, load it with bpf(), get it past the verifier, JIT it, attach it to a kernel event, and read data back through maps/ring buffers. The second half gets into why people use it for tracing, XDP packet filtering, security hooks, and sched_ext, then ends with the less fun part: the verifier is the safety boundary, and eBPF gets a lot scarier when the person loading the program already has access