eBPF: code that runs safely in the kernel
eBPF (Extended Berkeley Packet Filter) allows verified, sandboxed programs to run inside the Linux kernel at specific hook points — network events, system calls, tracepoints. Unlike kernel modules, eBPF programs are safety-verified before loading.
For networking, eBPF replaces iptables-based packet processing with C programs that compile to BPF bytecode — running at wire speed, modifiable without kernel patches.