eBPF on Linux — kprobe vs fentry: Hooking Internals & What Production Observability Misses

kprobe and fentry both hook kernel functions from eBPF, but they install differently, cost differently, and hand you arguments differently. A source-level comparison, grounded in a real eBPF project, plus why the choice is a production cost — not trivia.