Described are examples for providing fine-grained real-time pre-emption of codelets based on a runtime threshold. A controller inserts checkpoints into extended Berkeley packet filter (eBPF) bytecode of a third-party codelet prior to verification of the third-party codelet. A device executes the codelet at a hook point of an application. The inserted checkpoints determine a runtime of the codelet. The device terminates the codelet in response to the runtime exceeding a threshold. The application can be a virtualized radio access network (vRAN) network function and the codelet can control the vRAN function or export network metrics. The application may be executed in a container management system that modifies a container for the application to mount code including a function associated with the hook point of the application to the container; detect an annotation for the container that identifies the codelet; and symbolically links the codelet to the hook point.