Gobee: write eBPF programs in Go, transpiled via clang

Summary

Write your BPF programs in Go, not C. gobee transpiles a strict subset of Go into BPF C, generates typed Go bindings for the userspace side, and gates loads against the running kernel. The Go ecosystem has solid userspace tooling for BPF. The kernel side has always ended with "now write your program in C." Aya brought eBPF to Rust by writing a new BPF backend in rustc. gobee gets there a different way: by transpiling to C and reusing clang's mature backend. A Go file in, a BPF program out A tracepoint that streams every execve to userspace via a ringbuf: Your input (Go) What gobee emits (BPF C) //go:build ignore package main import "github.com/boratanrikulu/gobee/bpf" //bpf:license GPL type Event struct { Pid uint32 Comm [16]byte } var Events = bpf.RingBuf[Event]{ MaxEntries: 4096, } //bpf:section tracepoint/syscalls/sys_enter_execve func OnExec(ctx *bpf.ExecveEnterCtx) bpf.TpReturn { e, ok := Events.Reserve() if !ok { return bpf.TpOk } e.Pid = bpf.GetCurrentPid() bpf.GetTaskComm(&e.Comm) Events.Submit(e) return bpf.TpOk } func main() {} // Code generated by gobee. DO NOT EDIT. #include "vmlinux.h" #include <bpf/bpf_helpers.h> #include <bpf/bpf_core_read.h> char _license[] SEC("license") = "GPL"; struct Event { __u32 Pid; __u8 Comm[16]; }; struct { __uint(type, BPF_MAP_TYPE_RINGBUF); __uint(max_entries, 4096); } Events SEC(".maps"); SEC("tracepoint/syscalls/sys_enter_execve") int OnExec(struct trace_event_raw_sys_enter *ctx) { struct Event *e = bpf_ringbuf_reserve( &Events, sizeof(struct Event), 0); if (!e) { return 0; } e->Pid = (__u32)( bpf_get_current_pid_tgid() >> 32); bpf_get_current_comm(&e->Comm, 16); bpf_ringbuf_submit(e, 0); return 0; } gobee translate --bindings-dir ./bpf ./bpf/src produces both files, plus a sourcemap (events.bpf.c.map) so verifier errors map back to Go lines and a typed bindings file (bpf/events_bindings.go) so the userspace driver writes objs.Events, objs.AttachOnExec(), and decodes ringbuf payloads straight into bpf.Event (the same str...