eBPF support?

Any interest for a PR to add eBPF functionality?  I was imagining a tutorial "Mediacom" Docker container baked out of a simple config file that gave it not only bad network connections - but also problematic filesystem calls in a designated directory like /tmp/mediacom .