BumbleBee helps to build, run and distribute eBPF programs using OCI images. It allows you to focus on writing eBPF code, while taking care of the user space components - automatically exposing your data as metrics or logs.

Join the conversation on our Slack in the #bumblebee channel! If you need an invite to join, please try here.

• Installation
  • Install Bee
• Getting Started
  • What is eBPF?
  • Ramp up on BumbleBee concepts
  • Write your first BumbleBee program
• Developer Documentation
  • Contributing

The first step to get started is to install bee using one of the installation techniques listed below.

Once bee has been installed we can go ahead and initialize our first eBPF probe! To do this you just need to run one command! (no seriously that's it.) Note: This will only work on linux. If you don't have access to a linux machine, Vagrant will work as well!

sudo bee run ghcr.io/solo-io/bumblebee/tcpconnect:$(bee version)

To see data populated simply run curl httpbin.org in another window.

Note: If you installed bee via the install script you may see an issue with the bee command not being available when run with sudo. See the note on permissions for more info, but to quickly get started you can use the following command as an alternative:

sudo env "PATH=$PATH" bee run ghcr.io/solo-io/bumblebee/tcpconnect:$(bee version)

Now that you have run your first example program, you can go ahead and write your own with our tutorial.

Download the latest version:

curl -sL https://run.solo.io/bee/install | sh

Or download a given version (e.g. v0.0.8):

curl -sL https://run.solo.io/bee/install | BUMBLEBEE_VERSION=v0.0.8 sh

git clone [email protected]:solo-io/bumblebee.git
cd bumblebee
# install to GOBIN (defaults to ~/go/bin/), can be used as `bee` if GOBIN is on your PATH
go install ./bee

You can also navigate to the releases page here for more versions/information.

Loading eBPF programs to the kernel (bee run command) requires elevated privileges. You can either run bee as root (with sudo), or add capabilities to the binary. Adding capabilities is the preferred method, as if you run bee run with sudo, it will not find local images when you run bee build without sudo.

To add capabilities, run the following command:

sudo setcap cap_sys_resource,cap_sys_admin+eip $(which bee)

On newer kernels you may be able to pare down the capabilities added, for example a recent addition is the CAP_BPF capability.

If you installed bee via the install script, you can uninstall bee by removing the directory:

rm -rf $HOME/.bumblebee/

If you used bee as root or via sudo, remove the following directory:

rm -rf /root/.bumblebee

Apache 2

This project would not be possible without the valuable open-source work of projects in the eBPF community. Specifically, we would like to thank the eBPF go library and libbpf-tools.