CO-RE
also: Compile Once Run Everywhere
CO-RE (Compile Once – Run Everywhere) is a BPF technology that allows eBPF programs to be compiled once and run on different Linux kernel versions without recompilation, by automatically adapting to kernel structure layout differences.
CO-RE solves a major portability problem in eBPF development: kernel data structures change between versions, causing programs compiled on one kernel to fail on another. CO-RE uses DWARF debug information and runtime relocation to make eBPF programs portable across kernel versions.
During compilation, CO-RE captures information about kernel data structure layouts using DWARF metadata. At runtime, the kernel's BPF verifier adjusts memory offsets and field accesses based on the actual running kernel's structure definitions, transparently fixing any layout differences.
For example, a program accessing task_struct->pid compiled on kernel 5.10 can run unmodified on kernel 6.5, even though the internal layout of task_struct may have changed. Without CO-RE, you would need separate binaries for each kernel version.