Automic VaultAutomic Vault

brew

Install bpftop with Homebrew, apk, apt, dnf, Nix, pacman, zypper

Dynamic real-time view of running eBPF programs. Version 0.9.0 via Homebrew; verified 2026-07-04.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install bpftop

local Homebrew formula metadata

Linux

Alpine Linux apkverified · 92%
sudo apk add bpftop

Alpine Linux edge package indexes · bpftop · source: dl-cdn.alpinelinux.org

Debian aptverified · 92%
sudo apt install bpftop

Debian stable package indexes · bpftop · source: deb.debian.org

Fedora dnfverified · 92%
sudo dnf install bpftop

Fedora Rawhide package metadata · bpftop · source: dl.fedoraproject.org

Nixverified · 92%
nix profile install nixpkgs#bpftop

nixpkgs package indexes · pkgs/by-name/bp/bpftop/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S bpftop

Arch Linux sync databases · bpftop · source: geo.mirror.pkgbuild.com

openSUSE zypperverified · 92%
sudo zypper install bpftop

openSUSE Tumbleweed package metadata · bpftop · source: download.opensuse.org

overview

Package summary

Dynamic real-time view of running eBPF programs

Commands and aliases

  • bpftop

history

Project history and usage

bpftop is a top-like terminal monitor for running eBPF programs. It reports runtime, events per second, estimated CPU percentage, process references, and time-series graphs while enabling eBPF runtime statistics only while the tool is active.

Project history

The README describes bpftop as formerly maintained by Netflix and now independently maintained by Jose Fernandez, with Netflix no longer affiliated. The official announcement from Netflix introduced it as a way to streamline eBPF performance optimization.

The project appeared publicly in 2024, with a v0.1.0 tag in February 2024. Its README now documents install scripts, distribution packages, Linux kernel requirements, libelf/libz dependencies, journald integration, and a Rust/Cargo build.

Adoption history

bpftop's adoption path is tied to the rise of eBPF observability. The README points users to package-manager installs from Fedora, Arch Linux, and Nix, and the Homebrew input records additional packaging in apk, brew, Debian, Fedora, Nix, pacman, and zypper.

Because it requires root privileges and kernel eBPF statistics, adoption is mostly among systems, performance, and observability engineers rather than general CLI users.

How it is used

The normal workflow is `sudo bpftop`, optionally with a refresh delay. Users navigate with arrow keys or vim-style keys, filter programs, sort columns, and enter graph views for a selected eBPF program.

Internally, the README says bpftop uses the Linux `BPF_ENABLE_STATS` syscall command, samples statistics, and disables statistics gathering when the file descriptor is dropped on exit.

Why package nerds care

bpftop is significant because it packages a modern kernel-observability niche into a familiar top-like interface. For package maintainers, it is also a compact example of the newer Rust-plus-Linux-system-libraries tooling showing up in traditional Unix package collections.

Its package metadata tells a useful story: a tool announced from Netflix, later maintained independently, spreading quickly through Linux distributions and Homebrew because eBPF became operationally important.

Timeline

  • 2024: Official repository was created and v0.1.0 was tagged in February.
  • 2024: Netflix announced bpftop for eBPF performance optimization.
  • 2026: v0.9.0 tag appears in the official GitHub repository.
  • Current: README states the project is now independently maintained by Jose Fernandez.

Related projects

  • bpftop belongs with eBPF observability tools such as bpftrace, BCC tools, libbpf-based utilities, and kernel performance monitors.
  • Its interface lineage is the Unix `top` family: live tabular system state with sorting, filtering, and drill-down views.

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 2 platform targets.
  • Installs with 2 runtime dependencies.
  • Build metadata lists 3 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
bpftopcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.9.0
manager updated2026-07-04
local dataok
upstreamcurrent
latest detectedv0.9.0

https://github.com/jfernandez/bpftop

  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:bpftop
Version0.9.0
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/bpftop
Homepagehttps://github.com/jfernandez/bpftop
Repositoryhttps://github.com/jfernandez/bpftop
Upstream docshttps://github.com/jfernandez/bpftop#readme
LicenseApache-2.0
Source archivehttps://github.com/jfernandez/bpftop/archive/refs/tags/v0.9.0.tar.gz
Last updated2026-07-04T16:53:42+09:00
Pulseupdated
Dependencieselfutils, zlib-ng-compat
Build dependenciesllvm, pkgconf, rust
Bottleavailable (on arm64_linux, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namebpftop
Version Scheme0
Revision0
Head VersionHEAD
Requirements
  • linux
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

bpftop 0.5.2.20.gc23a822-2+b1

Provides a dynamic real-time view of running eBPF programs

https://github.com/Netflix/bpftop

sudo apt install bpftop
  • Section: admin
  • Architecture: amd64
  • Source Package: bpftop
  • 3 dependencies
  • normalized package name match
  • Matched by: Bpftop
Debian stable package indexes · deb.debian.org · Debian stable package indexes: bpftop from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

bpftop

nix profile install nixpkgs#bpftop
  • normalized package name match
  • Matched by: Bpftop
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/bp/bpftop/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
apk95%

bpftop 0.8.0-r1

Dynamic real-time view of running eBPF programs

https://github.com/Netflix/bpftop

sudo apk add bpftop
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: bpftop
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Bpftop
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: bpftop from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
dnf95%

bpftop 0.9.0-1.fc45

Dynamic real-time view of running eBPF programs

https://github.com/jfernandez/bpftop

sudo dnf install bpftop
  • License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Zlib AND (0BSD OR MIT OR Apache-2.0) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: bpftop
  • 7 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Bpftop
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: bpftop from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
pacman95%

bpftop 0.8.0-1

Dynamic real-time view of running eBPF programs

https://github.com/jfernandez/bpftop

sudo pacman -S bpftop
  • License: Apache-2.0
  • Architecture: x86_64
  • 4 dependencies
  • normalized package name match
  • Matched by: Bpftop
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: bpftop from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
zypper95%

bpftop 0.7.1-1.5

Dynamic real-time view of running eBPF programs

https://github.com/Netflix/bpftop

sudo zypper install bpftop
  • License: Apache-2.0
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: bpftop
  • 5 dependencies
  • 2 provides
  • normalized package name match
  • Matched by: Bpftop
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: bpftop from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • elfutilsRuntime dependency declared by Homebrew.
  • llvmBuild dependency declared by Homebrew.
  • pkgconfBuild dependency declared by Homebrew.
  • rustBuild dependency declared by Homebrew.

Same workflow

  • metricbeatShares av.db curated category or tags: cli, monitoring, observability, system.
  • rhitShares av.db curated category or tags: cli, observability, system.
  • sysdigShares av.db curated category or tags: cli, observability, system.
  • netdataShares av.db curated category or tags: cli, monitoring, observability, system.
  • zabbixShares av.db curated category or tags: cli, monitoring, observability, system.
  • apachetopShares av.db curated category or tags: cli, monitoring, system.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment