eBPF

eBPF programs run in a strictly sandboxed virtual machine inside the Linux kernel. Before loading, every program passes through a verifier that statically analyzes the bytecode to guarantee safety: no infinite loops, no out-of-bounds memory access, and no unauthorized kernel state modification. This ensures that even a misbehaving eBPF program cannot crash the kernel or compromise system stability, making it safe for production agent environments.

eBPF bytecode is translated into native machine instructions by a JIT compiler in the kernel. This means eBPF programs execute at near-native CPU speed, avoiding the overhead of interpretation. For agentic systems requiring real-time syscall monitoring or network packet filtering, JIT compilation ensures observability instrumentation adds negligible latency to critical paths.

eBPF enables runtime attachment to predefined hooks throughout the kernel without rebooting or recompiling. Key hook types include:

• kprobes/kretprobes: Dynamic tracing of any kernel function entry or return
• tracepoints: Stable, pre-defined instrumentation points in kernel subsystems
• uprobes: User-space function tracing for agent process introspection
• USDT probes: User-level statically defined tracing markers This allows DevSecOps teams to instrument agent behavior on demand.

eBPF programs use maps to store and share data between kernel and user space. These are generic key-value data structures with various backends optimized for different access patterns:

• Hash maps for fast lookups
• Ring buffers for lossless, high-throughput event streaming
• Per-CPU arrays for lock-free concurrent access
• LRU maps for bounded memory usage with automatic eviction Maps enable stateful monitoring of agent syscall patterns across multiple events.

eBPF programs are restricted from calling arbitrary kernel functions for safety. Instead, they invoke a curated set of helper functions that provide controlled access to kernel capabilities:

• bpf_get_current_pid_tgid() to identify the calling process
• bpf_perf_event_output() to stream data to user space
• bpf_tail_call() to chain programs together without returning to user space Tail calls enable modular, composable eBPF logic for complex agent security policies.

Compile Once, Run Everywhere (CO-RE) solves the portability challenge of eBPF across different kernel versions. It uses BTF (BPF Type Format) metadata to relocate field offsets and structure layouts at load time. A single compiled eBPF object can run on kernels from 5.4 to the latest release without recompilation, dramatically simplifying deployment across heterogeneous agent host fleets.

A Linux kernel facility that restricts a process to a predefined set of system calls. Once applied, the process enters a restricted state that cannot be reversed. For agent sandboxing, seccomp profiles prevent a compromised agent from making dangerous syscalls like ptrace, mount, or reboot, drastically reducing the kernel attack surface. eBPF programs can dynamically enforce and monitor seccomp violations in real time.

A minimalist virtual machine that uses hardware virtualization for strong isolation while stripping the guest kernel of unnecessary drivers. Unlike traditional VMs, MicroVMs boot in milliseconds and consume minimal memory. Firecracker, AWS's open-source MicroVM, runs Lambda and Fargate workloads. When combined with eBPF for host-level observability, MicroVMs provide defense-in-depth for agent execution.

The practice of monitoring and protecting execution environments in real time by detecting anomalous behavior. Key signals include:

• Unexpected system call sequences
• Unauthorized file access patterns
• Suspicious network connections to unknown IPs
• Process tree anomalies indicating privilege escalation

eBPF enables runtime security by attaching probes directly to kernel functions without loading kernel modules, providing deep visibility with minimal performance overhead.

A PEP intercepts an agent's request and enforces an authorization decision before the action executes. In an eBPF-augmented sandbox, the PEP operates at the kernel level, blocking unauthorized syscalls before they reach hardware. This architecture follows the zero-trust principle: every action is verified, regardless of where the agent runs. Combined with Open Policy Agent (OPA) for decision logic, PEPs create a decoupled, auditable enforcement layer.

A security control that prevents execution of any binary or script not on a pre-approved list. For agent sandboxes, this means:

• Blocking unauthorized tool installations
• Preventing curl | bash-style attacks
• Stopping interpreters from running arbitrary code

eBPF programs enforce allowlisting by hooking the execve syscall and validating the binary's hash or path against a known-good manifest before allowing execution to proceed.