A Deep Dive into eBPF: The Technology that Powers Tracee

This blog post introduces eBPF and Tracee, showing how to instrument the kernel to trace execve() system calls using BCC and Go bindings (kprobe/kretprobe, perf maps) with concrete code examples and a container-based demonstration; it emphasizes eBPF’s high-performance observability while noting its limitation that it can detect but not prevent malicious activity.