[bidandanswer]

> ebpf isn’t really novel beyond the interfaces it provides. They are just kernel modules that have been vetted and are sandboxed. Inserting executable code has been part of the kernel since forever in module form and kprobes.

This should be sung from the mountaintops. This concisely summarizes nearly everything that uninformed reader should take away from the comment section.