PythonBPF Documentation

Welcome to PythonBPF - a Python frontend for writing eBPF programs without embedding C code. PythonBPF uses llvmlite to generate LLVM IR and compiles directly to eBPF object files that can be loaded into the Linux kernel.

Note

This project is under active development.

What is PythonBPF?

PythonBPF is an LLVM IR generator for eBPF programs written in Python. It provides:

  • Pure Python syntax - Write eBPF programs in Python using familiar decorators and type annotations

  • Direct compilation - Compile to LLVM object files without relying on BCC

  • Full eBPF features - Support for maps, helpers, global definitions, and more

  • Integration with libbpf - Works with pylibbpf for object loading and execution

Quick Example

Here’s a simple “Hello World” BPF program that traces process creation:

from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe
from ctypes import c_void_p, c_int64

@bpf
@section("tracepoint/syscalls/sys_enter_execve")
def hello_world(ctx: c_void_p) -> c_int64:
    print("Hello, World!")
    return 0

@bpf
@bpfglobal
def LICENSE() -> str:
    return "GPL"

b = BPF()
b.load()
b.attach_all()
trace_pipe()

Features

  • Generate eBPF programs directly using Python syntax

  • Compile to LLVM object files for kernel execution

  • Built with llvmlite for IR generation

  • Supports maps, helpers, and global definitions for BPF

  • Companion project: pylibbpf, which provides bindings for libbpf

Table of Contents

Getting Started

User Guide

API Reference

License

PythonBPF is licensed under the Apache License 2.0.

Indices and tables