The entire eBPF bookshelf fits in one hand. The big four tech publishers (O’Reilly, Packt, Manning, Apress) have exactly three dedicated eBPF books between them, the newest from 2023, and none of the four has shipped a new one since. The only traditionally published arrival after that is a short 2025 BPB paperback that confusingly reuses the title of our top pick; more on that below. The scarcity makes picking the best eBPF books easier than most roundups, and it makes knowing what each book still gets right far more important, because parts of every one of them have aged.
This guide ranks the three dedicated eBPF titles plus the one adjacent book we would not trace a production system without, with an honest note on what each covers and where the 2019 material shows its age. If you are reading eBPF books to run Cilium as a production CNI or to debug clusters, the picks below map cleanly onto that work. Liz Rice, who wrote our top pick, also wrote Container Security, which leads the security shelf in our Docker and container book guide.
Current as of August 2026. All four editions and ISBNs below were checked against the publishers this week.
The four picks at a glance
One programming-first introduction, one giant tools reference, one short and aging primer, and one methodology book that teaches you what to trace in the first place.
| Book | Published | Focus | Best for |
|---|---|---|---|
| Learning eBPF | O’Reilly, 2023 | Writing eBPF programs, libbpf, CO-RE | Starting point for almost everyone |
| BPF Performance Tools | Addison-Wesley, 2019 | 150+ bcc and bpftrace tools | Performance work on live systems |
| Linux Observability with BPF | O’Reilly, 2019 | BPF program types, maps, XDP | A short programming primer |
| Systems Performance, 2nd Ed | Addison-Wesley, 2020 | Performance methodology, ch. 15 on BPF | The fundamentals under the tools |
1. Learning eBPF
The standout is not a close call. Liz Rice’s O’Reilly book from March 2023 is the newest dedicated eBPF book from a major publisher, and the only one written after libbpf and CO-RE became the standard way to ship portable eBPF programs.
Rice walks from “what is a BPF program” through maps, attachment points, and the verifier, into the networking and security program types that power Cilium and Tetragon. She is the chief open source officer at Isovalent, the Cilium company that is now part of Cisco, so the networking chapters come from someone who ships this in production. Watch the name when ordering: a 2025 BPB paperback by Michael Kehoe reuses the exact title Learning eBPF, and the Rice book is the O’Reilly one with the bee on the cover. The companion repo includes a VM config, and every example is small enough to type out and modify. If you plan to run Cilium CNI in a Kubernetes cluster, this book explains what the datapath is actually doing.
Buy it if you want to understand and write eBPF programs rather than only run other people’s tools. Skip it if your goal is purely performance analysis with ready-made tooling, because the Gregg book below hands you 150 finished tools while this one teaches you to build your own. It usually sells in the $40 to $60 band; check the current price on Amazon.
2. BPF Performance Tools
Brendan Gregg’s 880-page reference is the book you keep next to the terminal during an incident. It documents more than 150 ready-to-run bcc and bpftrace tools across CPUs, memory, filesystems, disks, networking, applications and containers, with the methodology for reading what they print.
This is the December 2019 print, and the age cuts two ways. The bcc and bpftrace tools it documents still ship in every major distro and still work, and Gregg keeps errata and updates on the official book page. What the book predates is the libbpf-tools rewrite of the bcc collection and the CO-RE packaging story, so treat the tool internals chapters as history and the tool usage chapters as current. For network digging it also pairs naturally with classic packet work like capturing Kubernetes pod packets with tcpdump, since bpftrace answers the “which process, which latency” questions tcpdump cannot.
Get it for production performance work; nothing else in print comes close for breadth. Skip it if you want to learn to write eBPF programs from scratch, because it teaches tool usage first and bpftrace one-liners second, not program development. Typical price sits in the $35 to $55 band; check the live price on Amazon.
3. Linux Observability with BPF
At roughly 180 pages, the Calavera and Fontana book is the quick programming primer of the set: BPF program types, maps, XDP and tc programs, all with C examples you can compile the same afternoon.
Honesty first: this is a November 2019 book and it shows more than the Gregg title does. The build workflow it teaches predates CO-RE, so you will be hand-compiling against kernel headers the way nobody does for new projects anymore. The concepts hold up well, particularly the program-type and map chapters, and the XDP material remains a readable introduction to a topic the other books treat briefly.
It suits a reader who wants a short, code-first tour before committing to a longer book, or who found a used copy cheap. Skip it if you are buying only one eBPF programming book, because Learning eBPF covers the same ground four years fresher. It is the cheapest of the set, often in the $25 to $45 band; check the current price on Amazon.
4. Systems Performance, 2nd Edition
Not an eBPF book, and it earns its slot anyway. Gregg’s 928-page second edition from December 2020 is the methodology layer under every tracing tool: how CPUs, memory, filesystems, disks and the network actually behave, and how to reason about a performance problem before you reach for a tracer.
Chapter 15 covers BPF directly with both BCC and bpftrace sections, and the perf and Ftrace chapters explain the older tracers eBPF tooling builds on. The reason this book makes an eBPF list is simple. A tracing tool tells you what the kernel did; this book teaches you whether that behavior is a problem. People who buy BPF Performance Tools without it end up with histograms they cannot interpret.
Buy it alongside either Gregg book, not instead of an eBPF title. Skip it if you already own the first edition and only want the BPF chapter, since the methodology core carries over. It runs in the $45 to $70 band new; check the live price on Amazon.
Why the eBPF bookshelf is so short
None of the big four tech publishers has shipped a new eBPF book since March 2023 because the free material moved faster than print can. The kernel gains new program types, helpers and verifier behavior every release cycle, and the community documents them on ebpf.io within weeks. The exceptions since then are a 234-page BPB paperback from August 2025 (the Kehoe title mentioned above, far shorter and far less reviewed than any pick here) and a handful of self-published Kindle titles. Two free O’Reilly reports fill the introductory gap as well: What Is eBPF? and Security Observability with eBPF, both distributed at no cost through Isovalent. Read the short report first if you are undecided, then buy Learning eBPF when you want depth.
The practical consequence: treat any eBPF book as a foundation, not a reference for current kernel capabilities. The program-type taxonomy, maps, the verifier’s job and the tooling landscape are stable enough for print. Specific helper lists, build workflows and kernel version requirements are not, and that is where the docs take over from every book on this page.
Which book to buy first
For most people, Learning eBPF. It is the newest, it covers the modern toolchain, and it makes the other three easier to read. If your day job is performance firefighting on Linux hosts, start with BPF Performance Tools instead and add Systems Performance when the histograms stop explaining themselves. Linux Observability with BPF is the budget pick for a code-first weekend read, bought with clear eyes about its 2019 toolchain. And if your interest is the broader platform reading list rather than eBPF alone, our Kubernetes book guide and the GitOps book roundup cover the layers above the kernel.
