Record · corpus.blog/posts/01a07df2-c5bd-7397-9d99-8d8f04653823

Hardening eBPF for runtime security: Lessons from Datadog Workload Protection

Datadog Engineering · published 7 January 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at datadoghq.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 38
Words captured: 7,984

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://www.datadoghq.com/product/workload-protection/

datadoghq.com

https://github.com/slackhq/go-audit

github.com

https://nakryiko.com/posts/bpf-core-reference-guide/

nakryiko.com

7.3-rc2: mainline Read at the source ↗

kernel.org

https://github.com/torvalds/linux/commit/eb166e522c77699fc19bfa705652327a1e51a117

github.com

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d71962f3e627b5941804036755c844fabfb65ff5

git.kernel.org

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c04c0d2b968ac45d6ef020316808ef6c82325a82

git.kernel.org

https://github.com/torvalds/linux/commit/28ead3eaabc16ecc907cfb71876da028080f6356

github.com

https://github.com/torvalds/linux/commit/c131187db2d3fa2f8bf32fdf4e9a4ef805168467

github.com

https://github.com/DataDog/ebpf-manager

github.com

https://elixir.bootlin.com/linux/v6.15.5/source/arch/x86/include/asm/thread_info.h

elixir.bootlin.com

https://man7.org/linux/man-pages/man2/openat2.2.html

man7.org

https://elixir.bootlin.com/linux/v6.15.5/source/include/linux/sched.h

elixir.bootlin.com

https://lists.iovisor.org/g/iovisor-dev/topic/accessing_user_memory_and/21386221

lists.iovisor.org

https://github.com/torvalds/linux/commit/0f8e4bd8a1fc8c4185f1630061d0a1f2d197a475

github.com

https://lpc.events/event/16/contributions/1368/attachments/1102/2113/LPC2022%20-%20Pressure%20feedback%20for%20LRU%20maps.pdf

lpc.events

https://github.com/torvalds/linux/commit/457f44363a8894135c85b7a9afd2bd8196db24ab

github.com

https://docs.datadoghq.com/security/workload_protection/linux_expressions

docs.datadoghq.com

https://bughunters.google.com/blog/6303226026131456/a-deep-dive-into-cve-2023-2163-how-we-found-and-fixed-an-ebpf-linux-kernel-vulnerability

bughunters.google.com

https://github.com/google/security-research/security/advisories/GHSA-hfqc-63c7-rj9f

github.com

https://github.com/Gui774ume/ebpfkit

github.com

https://www.blackhat.com/us-21/briefings/schedule/

blackhat.com

https://defcon.org/html/defcon-29/dc-29-speakers.html

defcon.org

https://www.blackhat.com/us-22/briefings/schedule/

blackhat.com

https://elixir.bootlin.com/linux/v6.13.7/source/include/uapi/linux/bpf.h

elixir.bootlin.com

https://docs.ebpf.io/linux/program-type/BPF_PROG_TYPE_SCHED_CLS/

docs.ebpf.io

https://www.youtube.com/watch?v=YK7GyEJdJGo

youtube.com

https://github.com/cloudflare/ebpf_exporter/blob/master/benchmark/README.md

github.com

https://www.crowdstrike.com/en-us/blog/falcon-content-update-preliminary-post-incident-report/

crowdstrike.com

https://cloud.google.com/blog/products/containers-kubernetes/bringing-ebpf-and-cilium-to-google-kubernetes-engine

cloud.google.com

https://lwn.net/Articles/798918/

lwn.net

https://azure.microsoft.com/en-us/blog/microsoft-and-isovalent-partner-to-bring-next-generation-ebpf-dataplane-for-cloudnative-applications-in-azure/

azure.microsoft.com

https://github.com/aws/containers-roadmap/issues/1027

github.com

https://lwn.net/Articles/1015105/

lwn.net

https://docs.datadoghq.com/security/workload_protection/guide/ebpf-free-agent/?tab=docker

docs.datadoghq.com

https://docs.datadoghq.com/network_monitoring/cloud_network_monitoring/

docs.datadoghq.com

https://www.datadoghq.com/product/universal-service-monitoring/

datadoghq.com

https://careers.datadoghq.com/all-jobs/?s=security&parent_department_Engineering%5B0%5D=Engineering&utm_source=engblog&utm_medium=corpsite&utm_campaign=engcommunity-2025-workloadprotection-ebpf&gh_src=hm4uekgj1us

careers.datadoghq.com