PythonBPF is a compiler for eBPF programs. You write the kernel side as ordinary Python functions with a few decorators, and it emits LLVM IR (via llvmlite) and then a BPF object file. There is no C, and it doesn't use BCC.
pylibbpf loads and attaches
the result, so the whole thing can live in one script. The example here
prints a line every time something calls execve.
Maps, structs, helpers, loops and calls between functions all work. There are still gaps, so bug reports are welcome.
from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe
from ctypes import c_void_p, c_int64
@bpf
@section("tracepoint/syscalls/sys_enter_execve")
def hello_world(ctx: c_void_p) -> c_int64:
print("Hello, World!")
return 0
@bpf
@bpfglobal
def LICENSE() -> str:
return "GPL"
b = BPF()
b.load()
b.attach_all()
trace_pipe()$ pip install pythonbpf pylibbpf
$ sudo python3 hello_world.pyTry it
The playground needs a wider screen than this. Open it in its own tab.
Each run gets its own Firecracker microVM, so you don't need root or a recent kernel. It's a shared machine, so you may have to queue. Open full screen · source
Documentation
- Installation and quick start
- User guide: decorators, maps, structs, helpers, compilation
- API reference
- Examples in the repo
Repositories
- Python-BPF
- The compiler. pythonbpf on PyPI
- pylibbpf
- libbpf bindings, used to load and attach programs and read maps. pylibbpf on PyPI
- pythonbpf-playground
- The playground above.
Talks
- Sep 2026 · IndiaFOSS, Bengaluru by the authors PythonBPF: now with loops, custom functions, and more maps! abstract
- 31 Jan 2026 · FOSDEM, Brussels by the authors PythonBPF: writing eBPF programs in Python video · slides · event
- 12 Dec 2025 · Linux Plumbers Conference, Tokyo by the authors Python-BPF: writing eBPF programs in pure Python video · slides · demos · event
There's also a longer demo video.
At PyCon
- 14 Nov 2026 · PyCon Hong Kong by Nizar Akbar Meilani Python eBPF: BCC C-String Runtime vs Python-BPF AST Ahead of Time talk · schedule
- 18 Oct 2026 · PyCon Taiwan by Nizar Akbar Meilani Python eBPF: BCC C-String Runtime vs Python-BPF AST Ahead of Time talk · slides and benchmarks
Authors
Varun R Mallya
Student at IIT Roorkee. Works on eBPF, Linux networking, profiling and LLVM, contributes to the kernel's BPF subsystem, and did GSoC with GNOME on eBPF in Sysprof.