Topics / #ebpf

Ebpf projects on GitHub

eBPF programs for kernel-level networking, tracing and security.

As of , the most-starred Ebpf projects on GitHub are cilium (25.7K stars), skywalking (25K stars) and bcc (22.7K stars). GitHub.Locker tracks 14 Ebpf repositories with 198.1K stars combined. The fastest-growing on October 18 was keploy, with +25 stars in a day.

14Projects
198.1KStars in total
+63Stars in a day
Browse in the catalog →github.com/topics/ebpf ↗

Hot right now

Most stars gained in a day · Oct 18

+25

keploy

keploy/keploy · ★ 18.6K

Keploy is an open-source tool that auto-generates API and integration tests from real traffic: it records your API calls, database queries and streaming events, then replays them as tests.

+11

portmaster

safing/portmaster · ★ 13.9K

Portmaster is a free, open-source application firewall for Windows and Linux that intercepts all network traffic on your machine, letting you monitor and block connections per app, filter DNS, and block trackers and malware with good defaults out of the box.

+6

cilium

cilium/cilium · ★ 25.7K

Cilium is open-source networking, security, and observability software built on an eBPF dataplane, used mainly as the networking layer of Kubernetes clusters.

+5

bcc

iovisor/bcc · ★ 22.7K

BCC (BPF Compiler Collection) is a toolkit for creating efficient kernel tracing and manipulation programs on Linux using eBPF. It also ships a large collection of ready-made tools for I/O analysis, networking, and monitoring.

The all-time top

14 projects · by stars

  1. #1 · cilium/cilium

    cilium

    Cilium is open-source networking, security, and observability software built on an eBPF dataplane, used mainly as the networking layer of Kubernetes clusters.

    25.7K
  2. #2 · apache/skywalking

    skywalking

    Apache SkyWalking is an open-source APM (Application Performance Monitoring) system for monitoring, tracing and diagnosing distributed systems. It is built for microservices, cloud native and container-based architectures.

    25K
  3. #3 · iovisor/bcc

    bcc

    BCC (BPF Compiler Collection) is a toolkit for creating efficient kernel tracing and manipulation programs on Linux using eBPF. It also ships a large collection of ready-made tools for I/O analysis, networking, and monitoring.

    22.7K
  1. 4

    keploy

    18.6Kkeploy/keploy · Go

    Keploy is an open-source tool that auto-generates API and integration tests from real traffic: it records your API calls, database queries and streaming events, then replays them as tests.

  2. 5

    kubesphere

    17.1Kkubesphere/kubesphere · Go

    KubeSphere is a container platform built on Kubernetes for managing cloud-native apps across multi-cloud, datacenter, and edge environments. It adds a developer-friendly web console, multi-tenancy, DevOps workflows, and a plug-and-play extension ecosystem on top of your clusters.

  3. 6

    ecapture

    15.5Kgojue/ecapture · C

    An open-source command-line security tool that uses eBPF to capture SSL/TLS traffic in plaintext — no CA certificate installation or MITM proxy needed. It can also audit shell commands and database queries on the host.

  4. 7

    opensnitch

    14.2Kevilsocket/opensnitch · Python

    OpenSnitch is an interactive application firewall for GNU/Linux, inspired by macOS's 'Little Snitch', that lets you see and approve or block each app's outgoing connections in real time.

  5. 8

    portmaster

    13.9Ksafing/portmaster · Go

    Portmaster is a free, open-source application firewall for Windows and Linux that intercepts all network traffic on your machine, letting you monitor and block connections per app, filter DNS, and block trackers and malware with good defaults out of the box.

  6. 9

    kubeshark

    12.1Kkubeshark/kubeshark · Go

    Kubeshark is an eBPF-powered network observability tool for Kubernetes that captures and indexes L4/L7 traffic with full Kubernetes context, decrypts TLS without managing keys, and lets both humans and AI agents query the data.

  7. 10

    kubescape

    11.8Kkubescape/kubescape · Go

    Kubescape is an open-source Kubernetes security platform that scans clusters, YAML files, Helm charts, and container images for misconfigurations and vulnerabilities, covering the whole lifecycle from development to runtime.

  8. 11

    perf-tools

    10.5Kbrendangregg/perf-tools · Shell

    A collection of command-line scripts for analyzing Linux performance using ftrace and perf_events (the 'perf' command), created by Brendan Gregg (author of the DTraceToolkit).

  9. 12

    bpftrace

    10.4Kbpftrace/bpftrace · C++

    bpftrace is a high-level tracing language and tool for Linux: it uses eBPF to trace the kernel and user applications with minimal overhead.

  10. 13

    allox-os

    313AlloxOrg/allox-os · Python

    A dedicated runtime for AI agents: it runs multiple agents and sessions inside a Kata-isolated VM and adds workspace isolation, checkpointing, rollback and observability on top of it.

  11. 14

    hivepaas

    306hivepaas/hivepaas · Go

    HivePaaS is a lightweight, self-hosted Platform-as-a-Service built on Docker Swarm, meant as a resource-efficient alternative to Heroku, Render, and Coolify for deploying apps on your own servers.

Often tagged together