Lunatik 5.0: scripting the Linux kernel with Lua, now with eBPF integration

Lunatik 5.0 is a framework that embeds Lua runtimes inside the Linux kernel so developers can write kernel extensions, drivers and probes in Lua. Scripts execute in-kernel and access kernel facilities through about 78 Lua modules: Netfilter, XDP and TC hooks, socket and netlink APIs, kprobes, per-CPU runtimes, fsnotify, sched_ext, eBPF maps, kernel threads, RCU tables and more. A user-space command-line tool manages loading and lifecycle of scripts and a C API lets other kernel modules instantiate Lunatik runtimes. Examples show live use: a kprobe-based syscall tracker that maps syscall symbols to addresses and counts invocations, and a simple character device that creates /dev/passwd to generate random printable characters.

The distribution targets Linux 6.6+ and documents runtime models (per-CPU runtimes, kernel threads, inter-runtime mailboxes), packet and eBPF integrations (bpf, bpf.map, skb, netfilter, tc, xdp), rich netlink/socket support, tracing and scheduling hooks, device drivers, structured data access (struct, rcu, set) and crypto features including encrypted script execution. Quick-start steps are provided (git clone, sudo make btf_install, make, sudo make install and a lunatik REPL). Licensing is dual MIT or GPL-2.0-only; funding and contribution guidance (crypto donations, SPI/PayPal, GitHub stars) are listed.