bcc VS libguestfs

But wait, there's more! Enter the BCC toolkit and library, your trusty sidekick in simplifying the arcane art of writing eBPF applications. With BCC by your side, you'll be wielding eBPF like a seasoned pro in no time.

Nice - I normally use [bash-readline](https://github.com/iovisor/bcc/blob/master/tools/bashreadlin...) when coworking/co-inhabiting a server or training someone.

One of the big wins is not so much “build and run your own stuff” but there are very nice low-cost (in terms of compute) performance utilities built on eBPF

https://github.com/iovisor/bcc

There are so many utilities in that list; there’s a diagram midway down the readme which tries to help show their uses. bcc-tools should be available in any distro.

Also, Brendan Gregg does a ton of performance stuff that is worth knowing about if you check out his other work. Not eBPF only. Flame graphs are useful.

Reference: https://github.com/iovisor/bcc/blob/master/libbpf-tools/memleak.c

In this article, we'll build a basic version of an HTTPS sniffer, inspired by bcc-sslsniff.py, but we'll use Rust and Aya. We're going to demonstrate the capabilities of uprobes by employing uprobe and uretprobe along with familiar maps like PerCpuArray, HashMap, and PerEventArray. This will be a straightforward example to help us explore how uprobes function.

As xpd program I am using the BCC example xdp_redirect_map.py in skb mode as my NIC does not support native mode, attaching the program to veth2 and a dummy function to veth3

https://github.com/iovisor/bcc/blob/master/docs/reference_gu...

We started off doing this, but you end up with enormous diffs which are themselves confusing. Example, only about 5% of this change is non-generated:

https://github.com/libguestfs/libguestfs/commit/5186251f8f68...

And inside the registry. The apparently correct way to distinguish them is using the build ID:

https://github.com/libguestfs/libguestfs/commit/824c74574893...

NDB works great but another option is libguestfs. https://libguestfs.org/

Have a look here

Consider using libguestfs.

There's a lot of useful command-line tooling for KVM and QEMU-based virt. Here's a small selection of useful tools:

• virsh — This[1] is libvirt's shell interface; and gives you access to the rich set of libvirt APIs.

• virt-builder — Use this for rapidly building minimal or customized virtual machines; it's greatly flexible; check out its man page[2]. And here's[3] a quick example that connects both virt-builder and virsh together.

• virt-install — Use this if you don't like the default build of the template images from virt-builder; it lets you create "headless" servers via 'kickstart' and Linux OS trees from the command-line.

• guestfish and libguestfs suite[4] — This rich set of tools help you in a variety of use-cases: repairing your broken disk images, editing, cloning, debugging disk images, and more. It has saved my behind a lot of times.

• qemu-img[5] – This Swiss Army knife lets you powerfully manipulate disk images (QCOW2, raw, et al) offline. Example operations include: create images, backing chains, offline snapshots, disk image merging, and convert disk images from one format to another, and more.

[1] https://libvirt.org/manpages/virsh.html

[2] https://libguestfs.org/virt-builder.1.html

[3] https://developer.fedoraproject.org/tools/virt-builder/about...

[4] http://libguestfs.org/

[5] https://qemu.readthedocs.io/en/latest/tools/qemu-img.html

That's a good point. As long as the project has a setup.py or pyproject.toml available, it can usually be installed from the repo. For libguestfs it looks like they do some pre-processing on their setup.py so that wouldn't work, it's lucky that they had this alternative set up already. :)

Nah, this virt-install preseed script is faster, or even just run virt-builder debian-10 and they're both libvirt not hacky qemu scripts