// the find
qmonnet/rbpf
Rust virtual machine and JIT compiler for eBPF programs
rbpf is a user-space eBPF interpreter and x86_64 JIT compiler written in Rust, letting you run eBPF bytecode outside the Linux kernel. It's useful for sandboxed plugin systems, network simulation, or anywhere you want eBPF's restricted instruction set without needing root. The Cranelift backend suggests someone has been experimenting with a second JIT backend, though it's unclear how complete that is.
The four distinct VM structs (Mbuff, FixedMbuff, Raw, NoData) for handling packet-data conventions are genuinely thoughtful — they let you run kernel-compiled programs without manually managing the sk_buff layout each time. The `no_std` support is real and tested, making this viable for embedded targets where most eBPF tooling falls apart. The assembler/disassembler pair is included and covers the full instruction set, so you can write and debug programs without external tooling. Dual MIT/Apache licensing removes the friction that GPL'd alternatives (like directly borrowing kernel verifier code) would create.
The verifier is explicitly a toy — it won't catch unsafe programs and is nothing like the kernel's static analysis. The JIT path is marked `unsafe` and will segfault on bad memory accesses rather than returning an error, so you cannot use it for anything untrusted without wrapping it in a subprocess. No map support is implemented, which rules out most real eBPF programs that rely on hash maps or arrays for state. The project's own README says it started as a learning exercise with no known use case, and the activity level (1115 stars after ~10 years, sparse recent commits) suggests it fills a niche but hasn't found widespread production adoption.