Skip to content

Instantly share code, notes, and snippets.

@frobware

frobware/bpfman-cli-walkthrough.md

Created February 11, 2026 14:39
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save frobware/5b813cf65598560d13b38fad7431f265 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save frobware/5b813cf65598560d13b38fad7431f265 to your computer and use it in GitHub Desktop.
Download ZIP
bpfman CLI walkthrough -- real output from every program type and output format
Raw
bpfman-cli-walkthrough.md

bpfman CLI Walkthrough

Real output from running bpfman against a live kernel, demonstrating every supported program type and output format. Each section follows the full lifecycle: load, attach, list, detach, unload.

Table of Contents

XDP

Load an XDP program from an OCI image, attach to a network interface, list programs and links, then clean up.

$ bpfman program load image --programs xdp:pass --image-url quay.io/bpfman-bytecode/xdp_pass:latest -o json
[
  {
    "record": {
      "program_id": 8145,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8145/bytecode.o",
        "program_name": "pass",
        "program_type": "xdp",
        "image_source": {
          "url": "quay.io/bpfman-bytecode/xdp_pass:latest",
          "digest": "sha256:4b6d4917984bf0fccb32fe19f0c02f3058a8769df0bac8e4cf41efb759c69708",
          "pull_policy": "IfNotPresent"
        }
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8145",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8145"
      },
      "meta": {
        "name": "pass"
      },
      "created_at": "2026-02-11T14:34:35.339645111Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8145,
        "name": "pass",
        "program_type": "xdp",
        "tag": "4b9d1b2c140e87ce",
        "loaded_at": "2026-02-11T14:34:34.404238683Z",
        "uid": 0,
        "btf_id": 8920,
        "has_btf_id": true,
        "map_ids": [6191],
        "has_map_ids": true,
        "jited_size": 79,
        "xlated_size": 96,
        "verified_insns": 9,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6191,
          "name": ".rodata",
          "map_type": "array",
          "key_size": 4,
          "value_size": 51,
          "max_entries": 1,
          "flags": 1152,
          "btf_id": 8919,
          "has_btf_id": true,
          "memlock": 8192,
          "has_memlock": true,
          "frozen": true
        }
      ]
    }
  }
]

PROG_ID=8145
$ bpfman program list
PROGRAM ID  TYPE  NAME  SOURCE
8145        xdp   pass  /tmp/bpfman-demo-2646754/programs/8145/bytecode.o

$ bpfman link list
$ bpfman link attach xdp --iface bpfman-demo -o json 8145
{
  "record": {
    "id": 1388,
    "program_id": 8145,
    "kind": "xdp",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/xdp/dispatcher_4026531840_215_1/link_0",
    "details": {
      "interface": "bpfman-demo",
      "ifindex": 215,
      "priority": 50,
      "position": 0,
      "proceed_on": [2],
      "nsid": 4026531840,
      "dispatcher_id": 8147,
      "revision": 1
    },
    "created_at": "2026-02-11T14:34:35.560711862Z"
  },
  "status": {
    "kernel": {
      "id": 1388,
      "program_id": 8149,
      "link_type": "tracing",
      "attach_type": "0",
      "target_obj_id": 8147,
      "target_btf_id": 3
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1388
$ bpfman program list
PROGRAM ID  TYPE  NAME  SOURCE
8145        xdp   pass  /tmp/bpfman-demo-2646754/programs/8145/bytecode.o

$ bpfman link list
LINK_ID  KIND  PROGRAM_ID  PIN_PATH
1388     xdp   8145        /tmp/bpfman-demo-2646754/fs/xdp/dispatcher_4026531840_215_1/link_0
$ bpfman link detach 1388

$ bpfman program unload 8145

XDP: jsonpath variable capture

The same XDP workflow using jsonpath output to capture IDs into shell variables (as shown by bpfman program load image --example).

$ BPFMAN_PROG_ID=$(bpfman program load image \
    --programs xdp:pass \
    --image-url quay.io/bpfman-bytecode/xdp_pass:latest \
    -o 'jsonpath={[0].record.program_id}')
BPFMAN_PROG_ID=8152
$ bpfman program list
PROGRAM ID  TYPE  NAME  SOURCE
8152        xdp   pass  /tmp/bpfman-demo-2646754/programs/8152/bytecode.o
$ BPFMAN_LINK_ID=$(bpfman link attach xdp --iface bpfman-demo \
    -o 'jsonpath={.record.id}' "$BPFMAN_PROG_ID")
BPFMAN_LINK_ID=1390
$ bpfman program list
PROGRAM ID  TYPE  NAME  SOURCE
8152        xdp   pass  /tmp/bpfman-demo-2646754/programs/8152/bytecode.o

$ bpfman link list
LINK_ID  KIND  PROGRAM_ID  PIN_PATH
1390     xdp   8152        /tmp/bpfman-demo-2646754/fs/xdp/dispatcher_4026531840_216_1/link_0
$ bpfman link detach 1390

$ bpfman program unload 8152

TC

Load a TC program, attach to both ingress and egress on the same interface, list to see both links, then detach and unload.

$ bpfman program load image --programs tc:stats --image-url quay.io/bpfman-bytecode/go-tc-counter:latest -o json
[
  {
    "record": {
      "program_id": 8159,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8159/bytecode.o",
        "program_name": "stats",
        "program_type": "tc",
        "image_source": {
          "url": "quay.io/bpfman-bytecode/go-tc-counter:latest",
          "digest": "sha256:af0d95f0cdd0c6541115258c4322c45e37f9cf2abf628bdea9eea479d8e83576",
          "pull_policy": "IfNotPresent"
        }
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8159",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8159"
      },
      "meta": {
        "name": "stats"
      },
      "created_at": "2026-02-11T14:34:36.823491982Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8159,
        "name": "stats",
        "program_type": "schedcls",
        "tag": "ead94553702a3742",
        "loaded_at": "2026-02-11T14:34:35.888134454Z",
        "uid": 0,
        "btf_id": 8957,
        "has_btf_id": true,
        "map_ids": [6208],
        "has_map_ids": true,
        "jited_size": 163,
        "xlated_size": 240,
        "verified_insns": 24,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6208,
          "name": "tc_stats_map",
          "map_type": "percpuarray",
          "key_size": 4,
          "value_size": 16,
          "max_entries": 8,
          "btf_id": 8955,
          "has_btf_id": true,
          "memlock": 2376,
          "has_memlock": true
        }
      ]
    }
  }
]

PROG_ID=8159
$ bpfman program list
PROGRAM ID  TYPE  NAME   SOURCE
8159        tc    stats  /tmp/bpfman-demo-2646754/programs/8159/bytecode.o

Attach ingress:

$ bpfman link attach tc --iface bpfman-demo --direction ingress --priority 50 -o json 8159
{
  "record": {
    "id": 1391,
    "program_id": 8159,
    "kind": "tc",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/tc-ingress/dispatcher_4026531840_217_1/link_0",
    "details": {
      "interface": "bpfman-demo",
      "ifindex": 217,
      "direction": "ingress",
      "priority": 50,
      "position": 0,
      "proceed_on": [0, 3, 30],
      "nsid": 4026531840,
      "dispatcher_id": 8161,
      "revision": 1
    },
    "created_at": "2026-02-11T14:34:36.980607169Z"
  },
  "status": {
    "kernel": {
      "id": 1391,
      "program_id": 8163,
      "link_type": "tracing",
      "attach_type": "0",
      "target_obj_id": 8161,
      "target_btf_id": 3
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_INGRESS=1391
$ bpfman program list
PROGRAM ID  TYPE  NAME   SOURCE
8159        tc    stats  /tmp/bpfman-demo-2646754/programs/8159/bytecode.o

$ bpfman link list
LINK_ID  KIND  PROGRAM_ID  PIN_PATH
1391     tc    8159        /tmp/bpfman-demo-2646754/fs/tc-ingress/dispatcher_4026531840_217_1/link_0

Attach egress:

$ bpfman link attach tc --iface bpfman-demo --direction egress --priority 50 -o json 8159
{
  "record": {
    "id": 1392,
    "program_id": 8159,
    "kind": "tc",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/tc-egress/dispatcher_4026531840_217_1/link_0",
    "details": {
      "interface": "bpfman-demo",
      "ifindex": 217,
      "direction": "egress",
      "priority": 50,
      "position": 0,
      "proceed_on": [0, 3, 30],
      "nsid": 4026531840,
      "dispatcher_id": 8165,
      "revision": 1
    },
    "created_at": "2026-02-11T14:34:37.204295299Z"
  },
  "status": {
    "kernel": {
      "id": 1392,
      "program_id": 8167,
      "link_type": "tracing",
      "attach_type": "0",
      "target_obj_id": 8165,
      "target_btf_id": 3
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_EGRESS=1392

Both links visible:

$ bpfman program list
PROGRAM ID  TYPE  NAME   SOURCE
8159        tc    stats  /tmp/bpfman-demo-2646754/programs/8159/bytecode.o

$ bpfman link list
LINK_ID  KIND  PROGRAM_ID  PIN_PATH
1391     tc    8159        /tmp/bpfman-demo-2646754/fs/tc-ingress/dispatcher_4026531840_217_1/link_0
1392     tc    8159        /tmp/bpfman-demo-2646754/fs/tc-egress/dispatcher_4026531840_217_1/link_0
$ bpfman link detach 1391

$ bpfman link detach 1392

$ bpfman program unload 8159

TCX

TCX uses native kernel support (kernel 6.6+) rather than dispatchers.

$ bpfman program load image --programs tcx:stats --image-url quay.io/bpfman-bytecode/go-tc-counter:latest -o json
[
  {
    "record": {
      "program_id": 8170,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8170/bytecode.o",
        "program_name": "stats",
        "program_type": "tcx",
        "image_source": {
          "url": "quay.io/bpfman-bytecode/go-tc-counter:latest",
          "digest": "sha256:af0d95f0cdd0c6541115258c4322c45e37f9cf2abf628bdea9eea479d8e83576",
          "pull_policy": "IfNotPresent"
        }
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8170",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8170"
      },
      "meta": {
        "name": "stats"
      },
      "created_at": "2026-02-11T14:34:37.846097926Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8170,
        "name": "stats",
        "program_type": "schedcls",
        "tag": "ead94553702a3742",
        "loaded_at": "2026-02-11T14:34:36.910697417Z",
        "uid": 0,
        "btf_id": 8986,
        "has_btf_id": true,
        "map_ids": [6223],
        "has_map_ids": true,
        "jited_size": 163,
        "xlated_size": 240,
        "verified_insns": 24,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6223,
          "name": "tc_stats_map",
          "map_type": "percpuarray",
          "key_size": 4,
          "value_size": 16,
          "max_entries": 8,
          "btf_id": 8984,
          "has_btf_id": true,
          "memlock": 2376,
          "has_memlock": true
        }
      ]
    }
  }
]

PROG_ID=8170
$ bpfman program list
PROGRAM ID  TYPE  NAME   SOURCE
8170        tcx   stats  /tmp/bpfman-demo-2646754/programs/8170/bytecode.o

Note the TCX link type in the kernel status -- no dispatcher_id (unlike TC):

$ bpfman link attach tcx --iface bpfman-demo --direction ingress --priority 50 -o json 8170
{
  "record": {
    "id": 1393,
    "program_id": 8170,
    "kind": "tcx",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/tcx-ingress/link_4026531840_218_8170",
    "details": {
      "interface": "bpfman-demo",
      "ifindex": 218,
      "direction": "ingress",
      "priority": 50,
      "nsid": 4026531840
    },
    "created_at": "2026-02-11T14:34:37.990156132Z"
  },
  "status": {
    "kernel": {
      "id": 1393,
      "program_id": 8170,
      "link_type": "tcx",
      "attach_type": "46",
      "ifindex": 218
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1393
$ bpfman program list
PROGRAM ID  TYPE  NAME   SOURCE
8170        tcx   stats  /tmp/bpfman-demo-2646754/programs/8170/bytecode.o

$ bpfman link list
LINK_ID  KIND  PROGRAM_ID  PIN_PATH
1393     tcx   8170        /tmp/bpfman-demo-2646754/fs/tcx-ingress/link_4026531840_218_8170
$ bpfman link detach 1393

$ bpfman program unload 8170

Tracepoint

Attach to a kernel tracepoint (syscalls/sys_enter_kill).

$ bpfman program load image --programs tracepoint:tracepoint_kill_recorder --image-url quay.io/bpfman-bytecode/go-tracepoint-counter:latest -o json
[
  {
    "record": {
      "program_id": 8174,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8174/bytecode.o",
        "program_name": "tracepoint_kill_recorder",
        "program_type": "tracepoint",
        "image_source": {
          "url": "quay.io/bpfman-bytecode/go-tracepoint-counter:latest",
          "digest": "sha256:ec37a7f80580df548039009662f29b21b79cf9a8af3ba3768f042b7397107016",
          "pull_policy": "IfNotPresent"
        }
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8174",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8174"
      },
      "meta": {
        "name": "tracepoint_kill_recorder"
      },
      "created_at": "2026-02-11T14:34:38.534970037Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8174,
        "name": "tracepoint_kill",
        "program_type": "tracepoint",
        "tag": "186082bfd761e3ad",
        "loaded_at": "2026-02-11T14:34:37.599592409Z",
        "uid": 0,
        "btf_id": 8996,
        "has_btf_id": true,
        "map_ids": [6229, 6231],
        "has_map_ids": true,
        "jited_size": 154,
        "xlated_size": 240,
        "verified_insns": 22,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6229,
          "name": "tracepoint_stat",
          "map_type": "percpuarray",
          "key_size": 4,
          "value_size": 8,
          "max_entries": 8,
          "btf_id": 8993,
          "has_btf_id": true,
          "memlock": 1352,
          "has_memlock": true
        },
        {
          "id": 6231,
          "name": ".rodata",
          "map_type": "array",
          "key_size": 4,
          "value_size": 25,
          "max_entries": 1,
          "flags": 1152,
          "btf_id": 8994,
          "has_btf_id": true,
          "memlock": 8192,
          "has_memlock": true,
          "frozen": true
        }
      ]
    }
  }
]

PROG_ID=8174
$ bpfman program list
PROGRAM ID  TYPE        NAME                      SOURCE
8174        tracepoint  tracepoint_kill_recorder  /tmp/bpfman-demo-2646754/programs/8174/bytecode.o
$ bpfman link attach tracepoint --tracepoint syscalls/sys_enter_kill -o json 8174
{
  "record": {
    "id": 1394,
    "program_id": 8174,
    "kind": "tracepoint",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/links/8174/syscalls_sys_enter_kill",
    "details": {
      "group": "syscalls",
      "name": "sys_enter_kill"
    },
    "created_at": "2026-02-11T14:34:38.674048221Z"
  },
  "status": {
    "kernel": {
      "id": 1394,
      "program_id": 8174,
      "link_type": "perf_event"
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1394
$ bpfman program list
PROGRAM ID  TYPE        NAME                      SOURCE
8174        tracepoint  tracepoint_kill_recorder  /tmp/bpfman-demo-2646754/programs/8174/bytecode.o

$ bpfman link list
LINK_ID  KIND        PROGRAM_ID  PIN_PATH
1394     tracepoint  8174        /tmp/bpfman-demo-2646754/fs/links/8174/syscalls_sys_enter_kill
$ bpfman link detach 1394

$ bpfman program unload 8174

Kprobe

Attach a kprobe to the kernel function try_to_wake_up.

$ bpfman program load image --programs kprobe:kprobe_counter --image-url quay.io/bpfman-bytecode/go-kprobe-counter:latest -o json
[
  {
    "record": {
      "program_id": 8179,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8179/bytecode.o",
        "program_name": "kprobe_counter",
        "program_type": "kprobe",
        "image_source": {
          "url": "quay.io/bpfman-bytecode/go-kprobe-counter:latest",
          "digest": "sha256:5543450e5475424c4ca06cdc1a5828d462bb41227d3a116c2b76ac39538368cb",
          "pull_policy": "IfNotPresent"
        }
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8179",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8179"
      },
      "meta": {
        "name": "kprobe_counter"
      },
      "created_at": "2026-02-11T14:34:39.195400739Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8179,
        "name": "kprobe_counter",
        "program_type": "kprobe",
        "tag": "dcb27b52d176007d",
        "loaded_at": "2026-02-11T14:34:38.260041814Z",
        "uid": 0,
        "btf_id": 9006,
        "has_btf_id": true,
        "map_ids": [6237, 6239],
        "has_map_ids": true,
        "jited_size": 142,
        "xlated_size": 216,
        "verified_insns": 19,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6237,
          "name": "kprobe_stats_ma",
          "map_type": "percpuarray",
          "key_size": 4,
          "value_size": 8,
          "max_entries": 1,
          "btf_id": 9003,
          "has_btf_id": true,
          "memlock": 400,
          "has_memlock": true
        },
        {
          "id": 6239,
          "name": ".rodata",
          "map_type": "array",
          "key_size": 4,
          "value_size": 14,
          "max_entries": 1,
          "flags": 1152,
          "btf_id": 9004,
          "has_btf_id": true,
          "memlock": 8192,
          "has_memlock": true,
          "frozen": true
        }
      ]
    }
  }
]

PROG_ID=8179
$ bpfman program list
PROGRAM ID  TYPE    NAME            SOURCE
8179        kprobe  kprobe_counter  /tmp/bpfman-demo-2646754/programs/8179/bytecode.o
$ bpfman link attach kprobe --fn-name try_to_wake_up -o json 8179
{
  "record": {
    "id": 1395,
    "program_id": 8179,
    "kind": "kprobe",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/links/8179/try_to_wake_up",
    "details": {
      "fn_name": "try_to_wake_up"
    },
    "created_at": "2026-02-11T14:34:39.326914463Z"
  },
  "status": {
    "kernel": {
      "id": 1395,
      "program_id": 8179,
      "link_type": "perf_event",
      "kprobe_address": 18446744072500606660
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1395
$ bpfman program list
PROGRAM ID  TYPE    NAME            SOURCE
8179        kprobe  kprobe_counter  /tmp/bpfman-demo-2646754/programs/8179/bytecode.o

$ bpfman link list
LINK_ID  KIND    PROGRAM_ID  PIN_PATH
1395     kprobe  8179        /tmp/bpfman-demo-2646754/fs/links/8179/try_to_wake_up
$ bpfman link detach 1395

$ bpfman program unload 8179

Kretprobe

Same image as kprobe, but loaded with kretprobe: prefix. The link details show "retprobe": true.

$ bpfman program load image --programs kretprobe:kprobe_counter --image-url quay.io/bpfman-bytecode/go-kprobe-counter:latest -o json
[
  {
    "record": {
      "program_id": 8184,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8184/bytecode.o",
        "program_name": "kprobe_counter",
        "program_type": "kretprobe",
        "image_source": {
          "url": "quay.io/bpfman-bytecode/go-kprobe-counter:latest",
          "digest": "sha256:5543450e5475424c4ca06cdc1a5828d462bb41227d3a116c2b76ac39538368cb",
          "pull_policy": "IfNotPresent"
        }
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8184",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8184"
      },
      "meta": {
        "name": "kprobe_counter"
      },
      "created_at": "2026-02-11T14:34:39.837448226Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8184,
        "name": "kprobe_counter",
        "program_type": "kprobe",
        "tag": "dcb27b52d176007d",
        "loaded_at": "2026-02-11T14:34:38.90213601Z",
        "uid": 0,
        "btf_id": 9016,
        "has_btf_id": true,
        "map_ids": [6245, 6247],
        "has_map_ids": true,
        "jited_size": 142,
        "xlated_size": 216,
        "verified_insns": 19,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6245,
          "name": "kprobe_stats_ma",
          "map_type": "percpuarray",
          "key_size": 4,
          "value_size": 8,
          "max_entries": 1,
          "btf_id": 9013,
          "has_btf_id": true,
          "memlock": 400,
          "has_memlock": true
        },
        {
          "id": 6247,
          "name": ".rodata",
          "map_type": "array",
          "key_size": 4,
          "value_size": 14,
          "max_entries": 1,
          "flags": 1152,
          "btf_id": 9014,
          "has_btf_id": true,
          "memlock": 8192,
          "has_memlock": true,
          "frozen": true
        }
      ]
    }
  }
]

PROG_ID=8184
$ bpfman program list
PROGRAM ID  TYPE       NAME            SOURCE
8184        kretprobe  kprobe_counter  /tmp/bpfman-demo-2646754/programs/8184/bytecode.o
$ bpfman link attach kprobe --fn-name try_to_wake_up -o json 8184
{
  "record": {
    "id": 1396,
    "program_id": 8184,
    "kind": "kretprobe",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/links/8184/ret_try_to_wake_up",
    "details": {
      "fn_name": "try_to_wake_up",
      "retprobe": true
    },
    "created_at": "2026-02-11T14:34:39.970028967Z"
  },
  "status": {
    "kernel": {
      "id": 1396,
      "program_id": 8184,
      "link_type": "perf_event",
      "kprobe_address": 18446744072500606660
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1396
$ bpfman program list
PROGRAM ID  TYPE       NAME            SOURCE
8184        kretprobe  kprobe_counter  /tmp/bpfman-demo-2646754/programs/8184/bytecode.o

$ bpfman link list
LINK_ID  KIND       PROGRAM_ID  PIN_PATH
1396     kretprobe  8184        /tmp/bpfman-demo-2646754/fs/links/8184/ret_try_to_wake_up
$ bpfman link detach 1396

$ bpfman program unload 8184

Uprobe

Attach a uprobe to malloc in libc.

$ bpfman program load image --programs uprobe:uprobe_counter --image-url quay.io/bpfman-bytecode/go-uprobe-counter:latest -o json
[
  {
    "record": {
      "program_id": 8189,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8189/bytecode.o",
        "program_name": "uprobe_counter",
        "program_type": "uprobe",
        "image_source": {
          "url": "quay.io/bpfman-bytecode/go-uprobe-counter:latest",
          "digest": "sha256:af510c85fe6f67f926fca2ecf751344a24667a4b296ab3e2d3550a10e87f92a2",
          "pull_policy": "IfNotPresent"
        }
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8189",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8189"
      },
      "meta": {
        "name": "uprobe_counter"
      },
      "created_at": "2026-02-11T14:34:40.490818836Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8189,
        "name": "uprobe_counter",
        "program_type": "kprobe",
        "tag": "dcb27b52d176007d",
        "loaded_at": "2026-02-11T14:34:39.55546411Z",
        "uid": 0,
        "btf_id": 9026,
        "has_btf_id": true,
        "map_ids": [6253, 6255],
        "has_map_ids": true,
        "jited_size": 142,
        "xlated_size": 216,
        "verified_insns": 19,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6253,
          "name": "uprobe_stats_ma",
          "map_type": "percpuarray",
          "key_size": 4,
          "value_size": 8,
          "max_entries": 1,
          "btf_id": 9023,
          "has_btf_id": true,
          "memlock": 400,
          "has_memlock": true
        },
        {
          "id": 6255,
          "name": ".rodata",
          "map_type": "array",
          "key_size": 4,
          "value_size": 14,
          "max_entries": 1,
          "flags": 1152,
          "btf_id": 9024,
          "has_btf_id": true,
          "memlock": 8192,
          "has_memlock": true,
          "frozen": true
        }
      ]
    }
  }
]

PROG_ID=8189
$ bpfman program list
PROGRAM ID  TYPE    NAME            SOURCE
8189        uprobe  uprobe_counter  /tmp/bpfman-demo-2646754/programs/8189/bytecode.o
$ bpfman link attach uprobe --target /lib64/libc.so.6 --fn-name malloc -o json 8189
{
  "record": {
    "id": 1397,
    "program_id": 8189,
    "kind": "uprobe",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/links/8189/malloc",
    "details": {
      "target": "/lib64/libc.so.6",
      "fn_name": "malloc"
    },
    "created_at": "2026-02-11T14:34:40.637966231Z"
  },
  "status": {
    "kernel": {
      "id": 1397,
      "program_id": 8189,
      "link_type": "perf_event"
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1397
$ bpfman program list
PROGRAM ID  TYPE    NAME            SOURCE
8189        uprobe  uprobe_counter  /tmp/bpfman-demo-2646754/programs/8189/bytecode.o

$ bpfman link list
LINK_ID  KIND    PROGRAM_ID  PIN_PATH
1397     uprobe  8189        /tmp/bpfman-demo-2646754/fs/links/8189/malloc
$ bpfman link detach 1397

$ bpfman program unload 8189

Uretprobe

Same image as uprobe, loaded with uretprobe: prefix. Link details show "retprobe": true.

$ bpfman program load image --programs uretprobe:uprobe_counter --image-url quay.io/bpfman-bytecode/go-uprobe-counter:latest -o json
[
  {
    "record": {
      "program_id": 8194,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8194/bytecode.o",
        "program_name": "uprobe_counter",
        "program_type": "uretprobe",
        "image_source": {
          "url": "quay.io/bpfman-bytecode/go-uprobe-counter:latest",
          "digest": "sha256:af510c85fe6f67f926fca2ecf751344a24667a4b296ab3e2d3550a10e87f92a2",
          "pull_policy": "IfNotPresent"
        }
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8194",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8194"
      },
      "meta": {
        "name": "uprobe_counter"
      },
      "created_at": "2026-02-11T14:34:41.160964497Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8194,
        "name": "uprobe_counter",
        "program_type": "kprobe",
        "tag": "dcb27b52d176007d",
        "loaded_at": "2026-02-11T14:34:40.225615195Z",
        "uid": 0,
        "btf_id": 9036,
        "has_btf_id": true,
        "map_ids": [6261, 6263],
        "has_map_ids": true,
        "jited_size": 142,
        "xlated_size": 216,
        "verified_insns": 19,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6261,
          "name": "uprobe_stats_ma",
          "map_type": "percpuarray",
          "key_size": 4,
          "value_size": 8,
          "max_entries": 1,
          "btf_id": 9033,
          "has_btf_id": true,
          "memlock": 400,
          "has_memlock": true
        },
        {
          "id": 6263,
          "name": ".rodata",
          "map_type": "array",
          "key_size": 4,
          "value_size": 14,
          "max_entries": 1,
          "flags": 1152,
          "btf_id": 9034,
          "has_btf_id": true,
          "memlock": 8192,
          "has_memlock": true,
          "frozen": true
        }
      ]
    }
  }
]

PROG_ID=8194
$ bpfman program list
PROGRAM ID  TYPE       NAME            SOURCE
8194        uretprobe  uprobe_counter  /tmp/bpfman-demo-2646754/programs/8194/bytecode.o
$ bpfman link attach uprobe --target /lib64/libc.so.6 --fn-name malloc -o json 8194
{
  "record": {
    "id": 1398,
    "program_id": 8194,
    "kind": "uretprobe",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/links/8194/ret_malloc",
    "details": {
      "target": "/lib64/libc.so.6",
      "fn_name": "malloc",
      "retprobe": true
    },
    "created_at": "2026-02-11T14:34:41.318033292Z"
  },
  "status": {
    "kernel": {
      "id": 1398,
      "program_id": 8194,
      "link_type": "perf_event"
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1398
$ bpfman program list
PROGRAM ID  TYPE       NAME            SOURCE
8194        uretprobe  uprobe_counter  /tmp/bpfman-demo-2646754/programs/8194/bytecode.o

$ bpfman link list
LINK_ID  KIND       PROGRAM_ID  PIN_PATH
1398     uretprobe  8194        /tmp/bpfman-demo-2646754/fs/links/8194/ret_malloc
$ bpfman link detach 1398

$ bpfman program unload 8194

Fentry

Load a fentry program from a local bytecode file and attach to do_unlinkat. The attach function is specified at load time as part of the program spec (fentry:test_fentry:do_unlinkat).

$ bpfman program load file --path ./fentry.bpf.o --programs fentry:test_fentry:do_unlinkat -o json
[
  {
    "record": {
      "program_id": 8200,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8200/bytecode.o",
        "program_name": "test_fentry",
        "program_type": "fentry",
        "attach_func": "do_unlinkat"
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8200",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8200"
      },
      "meta": {
        "name": "test_fentry"
      },
      "created_at": "2026-02-11T14:34:41.846018699Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8200,
        "name": "test_fentry",
        "program_type": "tracing",
        "tag": "1578545d161c43ae",
        "loaded_at": "2026-02-11T14:34:40.928138475Z",
        "uid": 0,
        "btf_id": 9045,
        "has_btf_id": true,
        "map_ids": [6270],
        "has_map_ids": true,
        "jited_size": 48,
        "xlated_size": 48,
        "verified_insns": 5,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6270,
          "name": ".rodata",
          "map_type": "array",
          "key_size": 4,
          "value_size": 52,
          "max_entries": 1,
          "flags": 1152,
          "btf_id": 9043,
          "has_btf_id": true,
          "memlock": 8192,
          "has_memlock": true,
          "frozen": true
        }
      ]
    }
  }
]

PROG_ID=8200
$ bpfman program list
PROGRAM ID  TYPE    NAME         SOURCE
8200        fentry  test_fentry  /tmp/bpfman-demo-2646754/programs/8200/bytecode.o
$ bpfman link attach fentry -o json 8200
{
  "record": {
    "id": 1399,
    "program_id": 8200,
    "kind": "fentry",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/links/8200/fentry_do_unlinkat",
    "details": {
      "fn_name": "do_unlinkat"
    },
    "created_at": "2026-02-11T14:34:42.000287732Z"
  },
  "status": {
    "kernel": {
      "id": 1399,
      "program_id": 8200,
      "link_type": "tracing",
      "attach_type": "24",
      "target_obj_id": 1,
      "target_btf_id": 69485
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1399
$ bpfman program list
PROGRAM ID  TYPE    NAME         SOURCE
8200        fentry  test_fentry  /tmp/bpfman-demo-2646754/programs/8200/bytecode.o

$ bpfman link list
LINK_ID  KIND    PROGRAM_ID  PIN_PATH
1399     fentry  8200        /tmp/bpfman-demo-2646754/fs/links/8200/fentry_do_unlinkat
$ bpfman link detach 1399

$ bpfman program unload 8200

Fexit

Same bytecode file as fentry, loaded with fexit:test_fexit:do_unlinkat.

$ bpfman program load file --path ./fentry.bpf.o --programs fexit:test_fexit:do_unlinkat -o json
[
  {
    "record": {
      "program_id": 8205,
      "load": {
        "object_path": "/tmp/bpfman-demo-2646754/programs/8205/bytecode.o",
        "program_name": "test_fexit",
        "program_type": "fexit",
        "attach_func": "do_unlinkat"
      },
      "license": "Dual BSD/GPL",
      "gpl_compatible": true,
      "handles": {
        "pin_path": "/tmp/bpfman-demo-2646754/fs/prog_8205",
        "map_pin_path": "/tmp/bpfman-demo-2646754/fs/maps/8205"
      },
      "meta": {
        "name": "test_fexit"
      },
      "created_at": "2026-02-11T14:34:42.533910503Z",
      "updated_at": "0001-01-01T00:00:00Z"
    },
    "status": {
      "kernel": {
        "id": 8205,
        "name": "test_fexit",
        "program_type": "tracing",
        "tag": "b8d36be6f512c554",
        "loaded_at": "2026-02-11T14:34:41.614273223Z",
        "uid": 0,
        "btf_id": 9054,
        "has_btf_id": true,
        "map_ids": [6275],
        "has_map_ids": true,
        "jited_size": 48,
        "xlated_size": 48,
        "verified_insns": 5,
        "memlock": 4096,
        "has_memlock": true,
        "gpl_compatible": true
      },
      "pin_present": true,
      "maps_present": true,
      "maps": [
        {
          "id": 6275,
          "name": ".rodata",
          "map_type": "array",
          "key_size": 4,
          "value_size": 52,
          "max_entries": 1,
          "flags": 1152,
          "btf_id": 9052,
          "has_btf_id": true,
          "memlock": 8192,
          "has_memlock": true,
          "frozen": true
        }
      ]
    }
  }
]

PROG_ID=8205
$ bpfman program list
PROGRAM ID  TYPE   NAME        SOURCE
8205        fexit  test_fexit  /tmp/bpfman-demo-2646754/programs/8205/bytecode.o
$ bpfman link attach fexit -o json 8205
{
  "record": {
    "id": 1400,
    "program_id": 8205,
    "kind": "fexit",
    "pin_path": "/tmp/bpfman-demo-2646754/fs/links/8205/fexit_do_unlinkat",
    "details": {
      "fn_name": "do_unlinkat"
    },
    "created_at": "2026-02-11T14:34:42.684134638Z"
  },
  "status": {
    "kernel": {
      "id": 1400,
      "program_id": 8205,
      "link_type": "tracing",
      "attach_type": "25",
      "target_obj_id": 1,
      "target_btf_id": 69485
    },
    "kernel_seen": true,
    "pin_present": true
  }
}

LINK_ID=1400
$ bpfman program list
PROGRAM ID  TYPE   NAME        SOURCE
8205        fexit  test_fexit  /tmp/bpfman-demo-2646754/programs/8205/bytecode.o

$ bpfman link list
LINK_ID  KIND   PROGRAM_ID  PIN_PATH
1400     fexit  8205        /tmp/bpfman-demo-2646754/fs/links/8205/fexit_do_unlinkat
$ bpfman link detach 1400

$ bpfman program unload 8205

Output Formats

All examples below use the same loaded XDP program and attached link.

table (default)

$ bpfman program list
PROGRAM ID  TYPE  NAME  SOURCE
8209        xdp   pass  /tmp/bpfman-demo-2646754/programs/8209/bytecode.o

$ bpfman link list
LINK_ID  KIND  PROGRAM_ID  PIN_PATH
1402     xdp   8209        /tmp/bpfman-demo-2646754/fs/xdp/dispatcher_4026531840_219_1/link_0

wide

$ bpfman program list -o wide
PROGRAM_ID  TYPE  NAME  MAP_IDS  LINK_IDS  ATTACH                            TAG               SOURCE
8209        xdp   pass  [6280]   1402      bpfman-demo (ifindex=219, pos=0)  4b9d1b2c140e87ce  /tmp/bpfman-demo-2646754/programs/8209/bytecode.o

$ bpfman link list -o wide
LINK_ID  KIND  PROGRAM_ID  ATTACH                            PIN_PATH                                                            CREATED_AT
1402     xdp   8209        bpfman-demo (ifindex=219, pos=0)  /tmp/bpfman-demo-2646754/fs/xdp/dispatcher_4026531840_219_1/link_0  2026-02-11T14:34:43Z

json

$ bpfman link list -o json
{
  "links": [
    {
      "id": 1402,
      "program_id": 8209,
      "kind": "xdp",
      "pin_path": "/tmp/bpfman-demo-2646754/fs/xdp/dispatcher_4026531840_219_1/link_0",
      "details": {
        "interface": "bpfman-demo",
        "ifindex": 219,
        "priority": 50,
        "position": 0,
        "proceed_on": [2],
        "nsid": 4026531840,
        "dispatcher_id": 8210,
        "revision": 1
      },
      "created_at": "2026-02-11T14:34:43Z"
    }
  ]
}

tree

$ bpfman link list -o tree
LINK_ID  KIND  PROGRAM_ID  PIN_PATH
1402     xdp   8209        /tmp/bpfman-demo-2646754/fs/xdp/dispatcher_4026531840_219_1/link_0

jsonpath

$ bpfman link list -o 'jsonpath={.links[0].id}'
1402

custom-columns

$ bpfman link list -o 'custom-columns=ID:.id,KIND:.kind,PROGRAM:.program_id'
ID    KIND  PROGRAM
1402  xdp   8209
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment