PythonBPF Playground

Write eBPF programs in Python and run them in a real Linux kernel from your browser.

What is PythonBPF?

PythonBPF compiles a subset of Python into eBPF bytecode through LLVM, without BCC. Its companion library, pylibbpf, loads and attaches the programs and gives you their maps from ordinary Python. The documentation covers the language.

How it works

When you press Run, you get your own Firecracker microVM with its own Linux kernel. Your program is compiled to LLVM IR (shown in the LLVM IR tab), checked by the kernel's BPF verifier, loaded and attached. Its output streams back to the Output tab. The Terminal tab is a root shell in the same VM, so try bpftool prog list while a program runs. Your last program is in /work/main.py.

Limits

• Only two VMs run at a time. If both are taken, you wait in a first-come, first-served queue, and the page shows your position.
• A session ends after 2 minutes without activity. Sessions have no time limit while nobody is waiting; once someone is, a session is capped at 10 minutes, with at least 2 minutes' notice.
• Each run stops after 20 seconds and at most 256 KB of output.
• The VM has no network access, and everything in it disappears when your session ends.
• One session per visitor at a time.

Safety

Programs run as root, but only inside the microVM. Each VM runs under Firecracker's jailer, which provides a chroot, an unprivileged user, an empty network namespace, seccomp filters and cgroup CPU and memory limits. Its root filesystem is read-only. If your program crashes the guest kernel, the VM restarts and nothing else is affected.

Sharing

Share puts your code, compressed, into the link itself. The server does not store any code.

Source

The playground is open source: github.com/pythonbpf/pythonbpf-playground. Bug reports for the compiler go to Python-BPF.