Skip to content
Liel AlmogSoftware engineer

Kernel-level security · Go & C

eBPF Shield

A per-process firewall that connects a browser control plane and backend services to a Go host agent and kernel-level eBPF enforcement on Linux.

Explore the organization

Why I built it

Building on my degree and systems programming knowledge, I explored how operating systems, networking, and process-aware security fit together. I was especially excited to connect Go in user space with C and eBPF programs running inside the Linux kernel.

Engineering approach

eBPF Shield separates policy management from enforcement. A React control plane gives users a place to manage organizations, hosts, processes, and firewall rules. FastAPI services coordinate those workflows and store their state in MongoDB.

On each protected Linux host, a Go agent observes processes and synchronizes policy with the backend. C and eBPF programs then apply process-aware network rules in the kernel. The project brings the product interface, APIs, host software, and kernel behavior into one system.

How eBPF Shield works

Explore the main parts of the project and how they fit together.

Inside the system

  1. A browser interface for organizations, protected hosts, processes, dashboards, and firewall rules.

  2. Human-facing and machine-facing APIs coordinate authentication, product workflows, and host synchronization.

  3. Persistent models connect users and organizations with hosts, processes, and the policies enforced on them.

  4. The Go agent observes processes, synchronizes policy, and bridges backend services with kernel-level enforcement.

  5. Programs running inside the Linux kernel apply process-aware network policy close to the traffic source.