How does it compare to github.com/iovisor/gobpf

[tamalsaha]

Hi,
I am trying to learn about eBPF and interested in writing BPF code in C and then call from my Go library. I am 2 weeks into my exploration into this. So, pardon my ignorance. How does it compare to https://github.com/iovisor/gobpf ?

Thanks.

[lmb]

Hi Tamal, From my point of view, gobpf is designed to instrument running systems for debugging. You can feed it C, and it will transparently compile it to eBPF. To achieve this, it calls a C++ library called libbcc which parses and preprocesses your C code and then compiles it using an embedded LLVM. This makes it very powerful. The downside is that you probably need to package libbcc including LLVM yourself. I my personal experience it is easy to get something running with gobpf, but it becomes incredibly hard to debug when something goes wrong. One of the biggest hurdles is the way data is serialised when reading / writing maps, which uses a custom string format. This package is designed to be used in long running services that use eBPF. You'll have to compile to eBPF yourself, but in return you get a pure Go package which is easy to debug and contains several orders of magnitude less code than gobpf. I personally also think that our API is a bit nicer that gobpf (especially for maps), but then I am biased :) Let me know if you have more questions!

[tamalsaha]

Thanks for the detailed answer. It is starting to make sense. I agree that shipping LLVM with prod application is not preferred. Instead precompile and bundle the generated ELF files. I also found https://github.com/andrewkroh/go-ebpf project which takes a similar view but uses gobpf to load ELF files.

One thing is not clear to me if the cBPF reference (especially the maps macros) https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md#maps is purely reference to kernel ABI or some custom helpers bcc project has written. The latter seems to be the case. Am I right?

[lmb]

Yes, the map macros are a BCC specific thing. The actual ABI is documented in the kernel. It's not too different from BCC though. You'll need some header files to get started, I recommend you have a look at the ones from the cilium project.

[nathanjsweet]

@tamalsaha I'm going to close this. Feel free to keep asking questions, of course.