ebpf_embedded_strategy: development_image: tracing_tools_available: true debug_symbols_available: true kernel_config_visible: true production_image: minimal_loader_included: true only_required_bpf_programs: true unprivileged_bpf_disabled: true attack_surface_reduced: true build_process: kernel_config_versioned: true bpf_objects_built_reproducibly: true target_architecture_validated: true release_artifacts_tracked: true ebpf_embedded_strategy: development_image: tracing_tools_available: true debug_symbols_available: true kernel_config_visible: true production_image: minimal_loader_included: true only_required_bpf_programs: true unprivileged_bpf_disabled: true attack_surface_reduced: true build_process: kernel_config_versioned: true bpf_objects_built_reproducibly: true target_architecture_validated: true release_artifacts_tracked: true ebpf_embedded_strategy: development_image: tracing_tools_available: true debug_symbols_available: true kernel_config_visible: true production_image: minimal_loader_included: true only_required_bpf_programs: true unprivileged_bpf_disabled: true attack_surface_reduced: true build_process: kernel_config_versioned: true bpf_objects_built_reproducibly: true target_architecture_validated: true release_artifacts_tracked: true ebpf_embedded_audit: kernel: kernel_version_checked: true bpf_support_enabled: true required_hooks_available: true architecture_jit_support_verified: true security: unprivileged_bpf_policy_reviewed: true capabilities_required_documented: true production_access_restricted: true attack_surface_evaluated: true runtime: cpu_overhead_measured: true memory_usage_measured: true long_running_test_completed: true failure_behavior_verified: true maintenance: bpf_program_versioned: true rollback_plan_available: true customer_support_workflow_defined: true ebpf_embedded_audit: kernel: kernel_version_checked: true bpf_support_enabled: true required_hooks_available: true architecture_jit_support_verified: true security: unprivileged_bpf_policy_reviewed: true capabilities_required_documented: true production_access_restricted: true attack_surface_evaluated: true runtime: cpu_overhead_measured: true memory_usage_measured: true long_running_test_completed: true failure_behavior_verified: true maintenance: bpf_program_versioned: true rollback_plan_available: true customer_support_workflow_defined: true ebpf_embedded_audit: kernel: kernel_version_checked: true bpf_support_enabled: true required_hooks_available: true architecture_jit_support_verified: true security: unprivileged_bpf_policy_reviewed: true capabilities_required_documented: true production_access_restricted: true attack_surface_evaluated: true runtime: cpu_overhead_measured: true memory_usage_measured: true long_running_test_completed: true failure_behavior_verified: true maintenance: bpf_program_versioned: true rollback_plan_available: true customer_support_workflow_defined: true - rebuild the image - deploy an update - reproduce the issue - hope the new logs are the right ones - measuring syscall frequency and latency - tracing I/O or filesystem behavior - observing network traffic on gateways and routers - collecting packet statistics with XDP - monitoring sensitive runtime events - profiling CPU or service bottlenecks - supporting remote diagnostics on deployed Linux devices - kernel version and BPF support - CPU architecture and JIT availability - enabled hooks and kernel configuration - memory and CPU overhead - privileges required to load programs - Yocto or Buildroot integration - difference between development and production images - a small eBPF program attached to a kernel event - a user-space loader that configures the program and reads data from BPF maps - Start from one real problem: latency, networking, syscall monitoring, security audit or field diagnostics. - Verify kernel support, architecture constraints and permissions. - Build a small proof of concept and measure overhead on the real target. - Integrate loader and BPF objects into the embedded build system. - Separate development tooling from the production image. - Define update, rollback, logging and support workflows.