eBPF is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.

It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.