Python eBPF: BCC C-String Runtime vs Python-BPF AST Ahead of Time
Nizar Akbar Meilani
Python developers writes eBPF historically used BCC, which embeds C code as strings and compiles at runtime via Clang/LLVM. In 2024, Python-BPF emerged, translating pure Python AST directly into BPF bytecode via llvmlite.
I profiled both with time, strace, and perf. The results are stark: BCC needs 0.4 s to start against Python-BPF's 0.02 s — 16–21 times less. Yet Python-BPF's parser has real gaps—no ctx.args0 support, no atomic map operations.
This talk reveals the middle-level performance data and trade-offs, helping you choose the right Python eBPF toolchain for your deployment.
說明
This talk compares two Python eBPF approaches: BCC (established, embeds C strings, compiles at runtime) vs Python-BPF (2024, pure Python AST to BPF bytecode). I'll present benchmarking methodology using time, strace, and perf, revealing where overhead occurs. The analysis covers start cost, system call counts, and CPU profile. I'll also discuss Python-BPF's current gaps: missing subscript handlers, non-atomic map operations, and parser limitations.
Repositories:
- Python-BPF: https://github.com/pythonbpf/Python-BPF
- pylibbpf, the libbpf bindings used with Python-BPF: https://github.com/pythonbpf/pylibbpf
- BCC: https://github.com/iovisor/bcc
Benchmark notes — the talk's evidence. The paths are vault paths. URL-encode the spaces when the form is filled.
- Pass 1, un-profiled:
Atlas/Dots/Things/PythonBPF/Benchmarks/BCC vs Python-BPF execve three-pass packaging pass 1 unprofiled RUSAGE.md- Pass 2, strace -T:
Atlas/Dots/Things/PythonBPF/Benchmarks/BCC vs Python-BPF execve three-pass packaging pass 2 strace-T.md- Pass 3, perf record:
Atlas/Dots/Things/PythonBPF/Benchmarks/BCC vs Python-BPF execve three-pass packaging pass 3 perf record.md- Callback ablation:
Atlas/Dots/Things/PythonBPF/Benchmarks/Ablation A-B empty callback vs print-constant BCC vs PBPF.md
Method notes:
- Misread benchmark rows:
Atlas/Dots/Things/eBPF/Benchmarks/Misread Benchmark Rows — sys_enter_unlink.md- Unsymbolized frames in perf record:
Atlas/Dots/Things/eBPF/Benchmarks/Unsymbolized Frames in perf record Profiles of BCC and Python-BPF.md
Framework internals:
- Python-BPF overview:
Atlas/Dots/Things/PythonBPF/PythonBPF.md- Architecture:
Atlas/Dots/Things/PythonBPF/Architecture.md- Compiler limitations:
Atlas/Dots/Things/PythonBPF/Limitations/Python-BPF Compiler Limitations.md- Kernel memory access, all three approaches:
Atlas/Dots/Things/PythonBPF/Benchmarks/Kernel Memory Access BCC vs Python-BPF vs libbpf CO-RE.md- Register access and argument mapping:
Atlas/Dots/Things/PythonBPF/Python-BPF Register Access in ctx and The Argument Mapping.md
** Complete Note Repository ** : github.com/nizarakbarm/knowledge-pipeline.
Nizar Akbar Meilani is a systems engineer specializing in Linux infrastructure, DevOps, SRE, and Infrastructure as Code. His analytical approach—prioritizing data over assumptions—was shaped by CTF reverse engineering in college. He has spoken at PyCon APAC 2024 ("WordPress Vulnerability Detection"), PyCon HK 2025 ("IPList to BPFRule: Python DDoS Mitigation"), and PyCon ID 2025 ("Python meets bpfilter and safeline"). Currently expanding into eBPF observability tooling for Python developers through empirical benchmarking. **Previous Talks:** - PyCon APAC 2024 - PyCon Hong Kong 2025 - PyCon Indonesia 2025