Expand description

A permissive library for managing eBPF programs.

oxidebpf allows a user to easily manage a pre-built eBPF object file, creating groups of programs based on functionality and loading them as units. For a quick getting-started, see the documentation for ProgramGroup’s new() and load() functions.

Note: by default, oxidebpf will load BPF programs with logging disabled. If you wish to enable logging, enable the log_buf feature. If the default log size (4096) is not large enough to hold the verifier’s logs, the load will fail. If you need more space, oxidebpf will pull a log size in bytes from the LOG_SIZE environment variable (e.g., LOG_SIZE=8192 ./my_program).


The slog Logger for the oxidebpf library. You can change the destination by accessing the drain control with LOGGER.1.set(your_new_drain).

The description of an individual eBPF program. Note: This is not the same as the eBPF program itself, the actual binary is loaded from a ProgramBlueprint.

Structure that parses eBPF objects from an ELF object.

A group of eBPF ProgramVersions that a user wishes to load from a blueprint. The loader will attempt each ProgramVersion in order until one successfully loads, or none do.

A group of eBPF Programs that a user wishes to load.


Enum describing how a ProgramGroup handles auto-mounting debugfs.

Message format for messages sent back across the channel

An enum of the different BPF program types.

Different Linux scheduling policies, intended to be paired with a priority number in the builder function polling_thread_priority of ProgramGroup.

Enum which describes how the blueprint will parse sections not covered in our eBPF ABI.


This trait specifies a map that can be read from or written to (e.g., array types).


Return the current process capabilities header and set.

Return the current memlock limit.