Notes on eBPF, and why runtime detection is finally interesting

Runtime detection used to feel like a compromise. If you couldn’t catch something at build time, you had to accept high overhead, coarse visibility, and a lot of noise. eBPF changed the shape of that trade-off.

What eBPF actually gives you

You attach small programs to kernel probes — syscalls, network events, file operations — and they run in a verified sandbox in kernel space. The overhead is small enough to leave on in production. The visibility is deep enough to see what a process is actually doing, not just what it claims to be doing.

For supply chain attacks specifically, this matters. A malicious package can hide from static analysis by fetching its payload at runtime. Once that payload runs, though, it has to make syscalls to do anything useful — open files, spawn processes, hit the network. eBPF sees all of that.

What I’m still figuring out

• How much of the noise reduction has to happen in userspace vs. in the eBPF program itself
• Whether tagging syscall traces with the responsible package is tractable in real deployments
• How much this changes when you factor in containers and orchestration

This one’s still growing. I’ll tend it as I understand more.