BumbleBee To Make eBPF Development Easier


BumbleBee is an open source project launched by, a service mesh provider. Its goal is to make developing eBPF applications easier by using auto-generated templates and boilerplate files. BumbleBee offers “rails” to aid development efforts, as well as a Docker-like environment.

Developers can use the eBPF technology to add custom logic to Linux kernels. Network monitoring and management is a popular use case. Sidecar proxies and service mesh data planes are increasingly using it. Most developers, however, find it difficult to create and deploy eBPF applications. The developer must write a kernel program in a language like C or Rust, compile it to eBPF using specialist compilers, deploy it into the target machine’s Linux kernel, and then write a user-space application to interface with the kernel program.

With a sophisticated technological stack like eBPF, providing “rails” (or opinionated archetypes) that automate the majority of the boilerplate code is a proven strategy for onboarding new engineers. New developers only need to write a few lines of code on the critical route, and the tool or framework will produce the entire program for them.

That’s exactly what BumbleBee does. It allows the developer to create the core eBPF code in C and then have the rest of the application generated for them, including tools for deploying the code into the kernel and even a user-space UI for interacting with the eBPF program. BumbleBee is the result of’s internal development work on eBPF programs.

To provide a familiar and consistent developer experience, BumbleBee uses a containerized build environment. Developers can package an ELF file containing an eBPF program, eBPF deployment tools, and an auto-generated user-space application in an OCI container image using BumbleBee tools. Developers could then download the container image, install the eBPF software in the image, and interact with it via the user-space application. eBPF programs might also be run in any containerized environment, such as K8s clusters, by developers.

BumbleBee provides a Docker-like experience for developers. To construct a new eBPF program, a developer simply utilises CLI tools like bee init, bee build, and bee run, then builds the eBPF program into an OCI image and runs the OCI image of the eBPF program. In the init stage, for example, the developer answers four questions about the type of eBPF program they wish to create, and the source code for the eBPF program is generated.

BumbleBee currently only supports C-based eBPF apps, however, support for Rust-based eBPF applications is on the way.


Please enter your comment!
Please enter your name here