How Linux BPF Iterators Make Kernel Data Accessible

Lucas and Luna explore BPF iterators, the Linux kernel feature that lets you traverse kernel data structures safely from user space. They unpack how iterators differ from traditional BPF programs, why they were introduced, and how tools like bpftool use them to expose everything from task lists to TCP sockets. With a concrete example of dumping open files per process, they show how BPF iterators turn kernel internals into readable streams without dangerous module hacks. The episode also touches on the VFS iterator, locking requirements, and why this matters for observability and security auditing in 2026. If you've ever wondered how modern eBPF tooling gets its data, this is the episode for you.

#BPFIterators #eBPF #Kernel #Linux #Observability #bpftool #Technology #OpenSource #Sysadmin #DevOps #Performance #SecurityAuditing #VFS #TaskIterator #TCPIterators #FexingoBusiness #BusinessPodcast #LinuxPodcast

Keep every episode free: buymeacoffee.com/fexingo