Why architecture matters here
eBPF observability matters because it eliminates the biggest cost of instrumentation: touching application code. Traditional observability requires adding tracing libraries, changing framework middleware, and redeploying. eBPF-based tools attach to kernel hooks and see everything — network flows, syscalls, function calls in user space — with no application changes.
Cost is remarkably low. eBPF programs run in JIT-compiled kernel space at near-native speed. Typical overhead is 1-3% of CPU. For that price you get metrics on every packet, every syscall, and every specified function.
Reliability under change is where eBPF wins. Application code changes constantly; kernel interfaces are stable. Instrumentation that lives outside the app doesn't break when the app is refactored.
The architecture: every piece explained
Walk the diagram top to bottom.
User Space App. Any application, unmodified. eBPF observability is transparent to it.
eBPF Program. A small C or Rust program compiled to eBPF bytecode. Loaded into the kernel through a system call.
Kernel Attach Point. Where the program runs. Tracepoints (predefined events), kprobes (dynamic kernel function probes), uprobes (user-space function probes), XDP (network driver level), TC (traffic control), and many others.
Verifier + JIT. Before loading, the kernel verifier proves the program is safe: no unbounded loops, no invalid memory access, terminates. Then the JIT compiles to native machine code for the target architecture.
eBPF Maps. Key-value stores shared between kernel and user space. The eBPF program writes; user space aggregator reads. Various map types: hash, array, ring buffer, perf event array.
Network probes. XDP intercepts packets at the driver level (fastest); TC works at the traffic control layer (more flexible). Cilium uses these for policy and observability.
Syscall probes. Tracepoints for syscall enter/exit; kprobes on internal functions. Base for tools like BCC, bpftrace, and Pixie.
User probes. uprobes attach to functions in user-space binaries. Pixie uses uprobes on libssl for TLS visibility without decryption.
Aggregator. User-space process that reads from maps, aggregates raw events into metrics, deduplicates, and enriches. Cilium Hubble, Pixie's Vizier, and Parca are typical.
Export. Standard observability backends via Prometheus scrape or OTel push. Integrates with existing dashboards and alerts.
End-to-end observability flow
Trace a scenario. You want to see p99 latency for every HTTP call your services make, without instrumenting the services.
Deploy Pixie (or beyla). It loads an eBPF program that uprobes into the SSL_read/SSL_write functions in libssl.so and TCP-level tracepoints.
When your service makes an HTTP request, the kernel traps the corresponding syscalls. The eBPF program captures the start time; the response captures the end. Data is written to a ring buffer map.
The aggregator reads events from the ring buffer, matches request-response pairs (correlated by socket + timing), computes latencies, and updates rolling histograms.
Every 10 seconds it exposes metrics via Prometheus endpoint. Grafana dashboards visualize p50/p99 per service per endpoint.
Same eBPF tool sees kernel-level events: TCP retransmits, DNS resolution time, connection failures. All without any change to the application. Any bug you'd catch by instrumenting is now visible without instrumenting.