Leo's take on security, eBPF, Linux, kernel, and whatever tech he meets
kfeatures is a pure-Go library that answers this question. It probes kernel capabilities at runtime and returns actionable diagnostics: not just unsupported , but why and how to fix it . if err := kfeatures . Check ( kfeatures . FeatureBPFLSM , kfeatures . FeatureBTF ); err != nil { var fe * kfeatures . FeatureError if errors . As ( err , & fe ) { log . Fatalf ( " %s - %s " , fe . Feature , fe .…
Declare your CLI contract once in Go structs. structcli turns it into flags, env vars, config-file loading, validation, organized help, and machine-readable contracts for agents. Less Cobra/Viper boilerplate Better CLIs for humans Better contracts for automation and LLMs Compiles to WASM out of the box Stop writing plumbing. Start shipping commands. ⚡ Quick Start § Start with a plain Go…
traffico is a collection of tools to shape traffic on a network using traffic control tc(8) . It can be used via a CLI tool ( traffico ) or as a CNI plugin ( traffico-cni ). For a list of the available programs and what they do see the Built-in programs section. The built-in programs are very opinionated and made for the needs of the authors but the framework is flexible enough to be used for…
I bet we all have heard so much about eBPF in recent years. Every day we hear about a new project or application using some eBPF black magic underneath. Data shows that eBPF is quickly becoming the first choice for implementing tracing and security applications. However, one major challenge is that the eBPF ecosystem lacks tooling to make developers' lives easier. eBPF programs are written in…
Three months ago, I was looking into building coverage for eBPF programs. That's how bpfcov was born. I did not want to reinvent the wheel, so I was looking into the existing coverage instrumentation features of LLVM. Among the different options LLVM provides, source-based code coverage suddenly appeared very appealing to me. It's the most precise type of code coverage. In my opinion,…
This project provides 2 main components: libBPFCov.so - an out-of-tree LLVM pass to instrument your eBPF programs for coverage. bpfcov - a CLI to collect source-based coverage from your eBPF programs. Overview § This section aims to provide a high-level overiew of the steps you need to get started with bpfcov . Compile the LLVM pass obtaining libBPFCov.so Instrument your eBPF program by compiling…
This repository provides a library to parse your commit messages according to the Conventional Commits v1.0 specification. Installation § go get github.com/leodido/go-conventionalcommits Docs § The parser/docs directory contains .dot and .png files representing the finite-state machines (FSMs) implementing the parser. Usage § Parse § Your code base uses only single line commit…
kubectl trace is a kubectl plugin that allows you to schedule the execution of bpftrace programs in your Kubernetes cluster. Installing § Krew § You can install kubectl trace using the Krew , the package manager for kubectl plugins. Once you have Krew installed just run: kubectl krew install trace You're ready to go! Pre-built binaries § See the release page for the full list of pre-built…
This is the official continuation of influxdata/go-syslog . To wrap up, this package provides: an RFC5424-compliant parser and builder an RFC3164-compliant parser - ie., BSD-syslog messages an auto-detect parser that determines RFC 3164 vs RFC 5424 format per-message an RFC3195 parser for syslog over BEEP (RAW and COOKED profiles) a parser that works on streams for syslog with octet counting…
Starting with version 1.3 this library also supports RFC 7643 SCIM URNs . Starting with version 1.4 this library also supports RFC 8141 URNs (2017) . Installation § go get github.com/leodido/go-urn Features § RFC 2141 URNs parsing (default) RFC 8141 URNs parsing (supersedes RFC 2141) RFC 7643 SCIM URNs parsing Normalization as per RFCs Lexical equivalence as per RFCs Precise,…
Compression will be handled by clean-css , which according to this benchmark is one of the top (probably the best) libraries for minifying CSS. Install § With npm do: npm install postcss-clean --save Example § Input § .try { color : #607d8b ; width : 32px ; } Output § .try { color : #607d8b ; width : 32px } Input § :host { display : block ; } :host ::content { & > * { color : var ( --primary-color…
Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time. At its core, Falco is a kernel monitoring and detection agent that observes events, such as syscalls, based on custom rules. Falco can enhance these events by integrating metadata from the container runtime and Kubernetes.…