marcsvll / bumblebee

Get eBPF programs running from the cloud to the kernel in 1 line of bash

BumbleBee helps to build, run and distribute eBPF programs using OCI images. It allows you to focus on writing eBPF code, while taking care of the user space components - automatically exposing your data as metrics or logs.

Documentation

• Installation
  • Install Bee
• Getting Started
  • What is eBPF?
  • Ramp up on BumbleBee concepts
  • Write your first BumbleBee program
• Developer Documentation
  • Contributing

---

Getting Started

The first step to get started is to install bee using one of the installation techniques listed below.

Once bee has been installed we can go ahead and initialize our first eBPF probe! To do this you just need to run one command! (no seriously that's it.) Note: This will only work on linux. If you don't have access to a linux machine, Vagrant will work as well!

sudo bee run ghcr.io/solo-io/bumblebee/tcpconnect:$(bee version)

To see data populated simply run curl httpbin.org in another window.

Note: If you installed bee via the install script you may see an issue with the bee command not being available when run with sudo. See the note on permissions for more info, but to quickly get started you can use the following command as an alternative:

sudo env "PATH=$PATH" bee run ghcr.io/solo-io/bumblebee/tcpconnect:$(bee version)

Now that you have run your first example program, you can go ahead and write your own with our tutorial.

Installation

Using our install script

curl -sL https://run.solo.io/bee/install | sh

Using go

# This will install directly to the configured GOBIN
go install github.com/solo-io/bumblebee/bee

Other options

You can also navigate to the releases page here for more versions/information.

A note on permissions

Loading eBPF programs to the kernel (bee run command) requires elevated privileges. You can either run bee as root (with sudo), or add capabilities to the binary. To add capabilities, run the following command:

sudo setcap cap_sys_resource,cap_sys_admin,cap_bpf+eip $(which bee)

Adding capabilities is the preferred method, as if you run bee run with sudo, it will not find local images when you run bee build without sudo.

Uninstall

If you installed bee via the install script, you can uninstall bee by removing the directory:

rm -rf $HOME/.bumblebee/

If you used bee as root or via sudo, remove the following directory:

rm -rf /root/.bumblebee

License

Apache 2

Thanks

This project would not be possible without the valuable open-source work of projects in the eBPF community. Specifically, we would like to thank the eBPF go library and libbpf-tools.