<div class="post-toc-block float-default with-border"> 
						<div class="post-toc-header">Table of Contents</div>
						<nav id="md-post-toc" class="md-post-toc"></nav>
						</div><h1>Introduction</h1>
<p>At <a href="https://keploy.io/">Keploy</a>, we wanted our tool to be part of the Github pipeline so that developers could be guaranteed that modifications made in pull requests could be safely merged and deployed. The only problem we had was ~ is it possible.</p>
<p>The reason for this question is because Keploy uses eBPF to track network calls, which requires sudo capabilities. So the question becomes, will GitHub grant users sudo rights for a program they construct and execute on their systems?</p>
<blockquote>
<p>If you&#8217;re interested in how eBPF can be used in other projects and environments like OpenWRT, check out our community post on <a href="https://keploy.io/blog/community/connecting-a-hosted-ui-website-to-an-aws-ec2-instance">Connecting a Hosted UI Website to an AWS EC2 Instance</a>.</p>
</blockquote>
<hr />
<h2>How does a regular merging cycle work?</h2>
<p>A typical merge cycle is simple: you create a PR, certain workflows are run, and if passed, the reviewer merges.</p>
<h2>How are the workflows run?</h2>
<p>A workflow is a customizable automated process that does one or more jobs. Workflows are defined by a <a href="https://keploy.io/blog/community/yaml-vs-yml-developers-guide-to-syntax-and-ease-of-use">YAML file</a> that is checked into your repository and will run when prompted by an event in your repository, manually, or on a set schedule.</p>
<pre><code>plaintext
|.github
    |-&gt;workflows
          |-&gt; go.yml #our sample workflow file</code></pre>
<p>So, in a normal merging cycle, these runners are used to check that the test of tests pre-computed rules are followed and that the program acts as expected.</p>
<hr />
<h2>What is eBPF and why do we use it?</h2>
<p>The extended Berkeley Packet Filter (eBPF) enables the programmable, safe, and efficient tracing and monitoring of kernel and user-space processes. So, by monitoring system calls, we&#8217;ll be able to see incoming and outgoing calls to the program without having to interact with the application code.</p>
<blockquote>
<p>Want to understand <strong>what information can eBPF tell us about an incoming packet</strong>? It includes metadata like packet size, destination IP, ports, and protocol type—perfect for tracing network activity without interfering with app logic.</p>
</blockquote>
<p>We intend to run this process whenever a pull request is sent to the main branch.</p>
<h2>Running eBPF in runner</h2>
<p>A sample workflow to run Keploy in github action would look like something below.</p>
<pre><code>yaml
name: Golang On Linux
on: [pull_request]
jobs:
  golang_linux:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    - name: Build binary
      run: |
        go build -o keployv2 //Build the binary

    - name: Run samples-go application
      run: |
        cd samples-go/gin-mongo
        source ./../../.github/workflows/golang-linux.sh //the script</code></pre>
<p>The script for the aforementioned runner might look something like this. In my example, I used the Keploy repository to run in &quot;record&quot; and &quot;test&quot; mode to track network calls.</p>
<pre><code>bash
#!/bin/bash

# Start mongo before starting binary.
docker run --rm -d -p27017:27017 --name mongoDb mongo

# Build the binary of the app to be traced with eBPF program.
go build -o ginApp

# Start the gin-mongo app in record mode and record testcases and mocks.
sudo -E env PATH=&quot;$PATH&quot; ./../../keployv2 record -c &quot;./ginApp&quot; --generateGithubActions=false &amp;

sleep 15
# Get the pid of the application.
pid=$(pgrep keploy)

curl -X GET http://localhost:8080/CJBKJd92

# Wait for 5 seconds for keploy to record the tcs and mocks.
sleep 5

# Stop the gin-mongo app.
sudo kill $pid

# Wait for 5 seconds for keploy to stop.
sleep 5
done

# Start the gin-mongo app in test mode.
sudo -E env PATH=&quot;$PATH&quot; ./../../keployv2 test -c &quot;./ginApp&quot; --delay 7 --generateGithubActions=false</code></pre>
<hr />
<h2>How can we gain the ability to read network calls?</h2>
<p>Cgroups (control groups) are a Linux kernel feature that hierarchically organizes processes and distributes system resources in a controlled and flexible manner.</p>
<p>GitHub-hosted runners do not provide access to edit or configure cgroups due to their secure multi-tenant environment.</p>
<p>So how are we capturing network activity?</p>
<p>We use <strong>eBPF hooks</strong> (specifically kprobes) that don’t require cgroup manipulation. Our Keploy implementation can still observe system calls and packet information passively.</p>
<blockquote>
<p>Want to go deeper into how this tech links with native code? Check out <a href="https://keploy.io/blog/community/java-native-interface">Java Native Interface</a> on our blog.</p>
</blockquote>
<p>Additionally, if you&#8217;re deploying in OpenWRT environments, you might be curious <strong>how to enable eBPF in the kernel in OpenWRT</strong>. It typically involves enabling kernel config options like <code>CONFIG_BPF</code> and <code>CONFIG_BPF_SYSCALL</code>, then recompiling the firmware.</p>
<h2>The results of running eBPF:</h2>
<p>Github and Gitlab both give us sudo privileges for runners (letting us attach hooks on kprobes). Bitbucket, on the other hand, does not.</p>
<p>These configurations helped us learn we need custom runners for ARM64 architecture. Below is a snippet that demonstrates HTTP requests being captured multiple times by Keploy.</p>
<h2>Conclusion</h2>
<p>There are a few learnings from this venture:</p>
<ul>
<li>
<p>GitHub runner does give us root-like privilege by allowing us to attach hooks to kprobes.</p>
</li>
<li>
<p>GitHub runners are 2-core, 7 GB RAM, 14 GB SSD disk space beasts, perfect for running <a href="https://keploy.io/blog/community/ebpf-for-tls-traffic-tracing-secure-efficient-observability">eBPF based tools</a>.</p>
</li>
<li>
<p><strong>GitHub integration</strong> is possible even with root-level operations like network monitoring using eBPF.</p>
</li>
</ul>
<blockquote>
<p>For more insights into developer tools, tech communities, and tips, check out <a href="https://keploy.io/blog/community/10-developer-communities-to-be-a-part-of-in-2025">10 Developer Communities to Be a Part of in 2025</a> on our blog.</p>
</blockquote>
<h3>Explore more eBPF and integration use cases on <a href="https://www.keploy.io/">www.keploy.io</a>.</h3>
<p>FAQ’S</p>
<p><strong>1. Can eBPF run inside GitHub Actions without full root access?</strong><br />
Yes, eBPF can run in GitHub Actions because it attaches to kernel hooks like kprobes.<br />
These hooks don’t require full root or cgroup configuration access.<br />
GitHub runners provide limited sudo privileges, which are enough for Keploy.<br />
This allows passive network tracing during pull requests safely.</p>
<p><strong>2. What kind of data can eBPF extract from incoming packets?</strong><br />
eBPF can capture metadata like source and destination IPs, ports, and protocols.<br />
It can also track packet sizes, timings, and system call context.<br />
This makes it useful for tracing and debugging network activity.<br />
All this happens without modifying the application code.</p>
<p><strong>3. How do you enable eBPF in OpenWRT?</strong><br />
To enable eBPF in OpenWRT, you need to recompile the kernel with BPF options.<br />
Enable flags like <code>CONFIG_BPF</code> and <code>CONFIG_BPF_SYSCALL</code> in kernel config.<br />
Also include bpftool and required headers for runtime utilities.<br />
Then flash the firmware and verify with <code>bpftool</code> commands.</p>
<p><strong>4. Why does Keploy use eBPF in its GitHub workflow?</strong><br />
Keploy uses eBPF to monitor network calls without touching the app code.<br />
This lets it auto-generate test cases and mocks by passively observing traffic.<br />
Running it in GitHub ensures every PR gets verified safely.<br />
It’s a powerful way to integrate deep network tracing into CI/CD.</p>
<p><strong>5. How is GitHub integration handled for eBPF-based tools like Keploy?</strong><br />
GitHub workflows use YAML files to define steps and runners.<br />
Keploy is built, run, and tested in these workflows using sudo where needed.<br />
The eBPF logic runs inside custom bash scripts that are triggered per PR.<br />
This seamless integration allows consistent testing across environments.</p>

         
        
                    

                    
                    <div class="pp-multiple-authors-boxes-wrapper pp-multiple-authors-wrapper pp-multiple-authors-layout-boxed multiple-authors-target-the-content box-post-id-16 box-instance-id-1 ppma_boxes_16"
                    data-post_id="16"
                    data-instance_id="1"
                    data-additional_class="pp-multiple-authors-layout-boxed.multiple-authors-target-the-content"
                    data-original_class="pp-multiple-authors-boxes-wrapper pp-multiple-authors-wrapper box-post-id-16 box-instance-id-1">
                                                                                    <h2 class="widget-title box-header-title">Author</h2>
                                                                            <span class="ppma-layout-prefix"></span>
                        <div class="ppma-author-category-wrap">
                                                                                                <span class="ppma-category-group ppma-category-group-">
                                                                                                                        <ul class="pp-multiple-authors-boxes-ul">
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            <li class="pp-multiple-authors-boxes-li author_index_0 author_shivam-sourav-jha has-avatar">
                                                                                                                                                                                                                                            <div class="pp-author-boxes-avatar">
                                                                                                                                            <img alt='Shivam Sourav Jha' src='https://wp.keploy.io/wp-content/uploads/2024/10/shivam-sourav-jha.jpg' srcset='https://wp.keploy.io/wp-content/uploads/2024/10/shivam-sourav-jha.jpg' class='multiple_authors_guest_author_avatar avatar' height='80' width='80'/>                                                                                                                                    </div>
                                                            
                                                            <div class="pp-author-boxes-avatar-details">
                                                                                                                                                                                                <div class="pp-author-boxes-name multiple-authors-name">
                                                                        <a href="https://wp.keploy.io/author/shivam-sourav-jha/" rel="author" title="Shivam Sourav Jha" class="author url fn">Shivam Sourav Jha</a> 
                                                                    </div>
                                                                                                                                                                                                                                                                    <p class="pp-author-boxes-description multiple-authors-description">
                                                                        I'm a software developer passionate about breaking and experimenting with technology, exploring new tech through hands-on experimentation.                                                                    </p>
                                                                                                                                <a class="ppma-author-user_url-profile-data ppma-author-field-meta ppma-author-field-type-url" aria-label="Website" href="https://www.linkedin.com/in/shivamsouravjha/" rel="dofollow" target="_blank"><span class="dashicons dashicons-admin-links"></span> </a>
                                                                                                                                
                                                                                                                            </div>
                                                                                                                                                                                                                                                                                                                                                                                                             </li>
                                                                                                                                                                                                                                    </ul>
                                                                            </span>
                                                                                    </div>
                    <span class="ppma-layout-suffix"></span>
                    </div>
                    
                    
                
                                <style>
                .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { width: 80px !important; height: 80px !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { border-style: none !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { border-radius: 50% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a:hover { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { border-radius: 100% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { border-radius: 100% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-recent-posts-title { border-bottom-style: dotted !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-style: solid !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-width: 1px !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-color: #999 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { color: #3c434a !important; }             </style>

Executing EBPF in Github Actions

Tracking Multiple Requests Over a Single Connection with eBPF

Capturing Multiple Requests on the Same Connection with eBPF

Codium vs Copilot: Which AI Coding Assistant is Best for You?

Coding AI: Best Free AI Code Generators and Tools for 2025

How to Clone a Project from GitHub Using HTTPS: A Complete Guide

eBPF for TLS Traffic Tracing: Secure & Efficient Observability

Building Keploy.io, an EBPF based open source framework to generate test cases and data stubs from API calls.

Neha Gupta

Cloud technology veteran and probably the youngest (globally) to have completed all 5 AWS certifications (including Solutions architect Professional and Dev­ops engineer professional)

Executing Ebpf In Github Actions

More Stories