Python eBPF: BCC C-String Runtime vs Python-BPF AST Ahead of Time

This talk compares two Python eBPF approaches: BCC (established, embeds C strings, compiles at runtime) vs Python-BPF (2024, pure Python AST to BPF bytecode). I'll present benchmarking methodology using time, strace, py-spy, and perf, revealing where overhead occurs. The analysis covers startup latency, syscall footprint, CPU flame graphs, and call chain analysis. I'll also discuss Python-BPF's current gaps: missing subscript handlers, non-atomic map operations, and parser limitations.

References:

• Python-BPF repository: https://github.com/python-bpf/python-bpf
• BCC repository: https://github.com/iovisor/bcc
• Related research notes from knowledge-pipeline:
  • PythonBPF Overview: https://github.com/nizarakbarm/knowledge-pipeline/blob/main/Atlas/Dots/Things/PythonBPF/PythonBPF.md
  • PythonBPF Architecture: https://github.com/nizarakbarm/knowledge-pipeline/blob/main/Atlas/Dots/Things/PythonBPF/Architecture.md
  • Python-BPF Compiler Limitations: https://github.com/nizarakbarm/knowledge-pipeline/blob/main/Atlas/Dots/Things/PythonBPF/Python-BPF%20Compiler%20Limitations.md
  • Kernel Memory Access Comparison: https://github.com/nizarakbarm/knowledge-pipeline/blob/main/Atlas/Dots/Things/PythonBPF/Kernel%20Memory%20Access%20BCC%20vs%20Python-BPF%20vs%20libbpf%20CO-RE.md
  • Python-BPF Register Access: https://github.com/nizarakbarm/knowledge-pipeline/blob/main/Atlas/Dots/Things/PythonBPF/Python-BPF%20Register%20Access%20in%20ctx%20and%20The%20Argument%20Mapping.md
  • BCC vs Python-BPF Benchmark Plan: https://github.com/nizarakbarm/knowledge-pipeline/blob/main/Efforts/On/BCC%20vs%20Python-BPF%20Benchmark%20Plan.md
  • BCC Overview: https://github.com/nizarakbarm/knowledge-pipeline/blob/main/Atlas/Dots/Things/BCC%20eBPF/BCC.md
  • eBPF Overview: https://github.com/nizarakbarm/knowledge-pipeline/blob/main/Atlas/Dots/Things/eBPF/eBPF%20(extended%20Berkeley%20Packet%20Filter).md