Falco Versions Save

Cloud Native Runtime Security

0.36.1

7 months ago

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.36.1`
`docker pull public.ecr.aws/falcosecurity/falco:0.36.1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.36.1`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.36.1`
`docker pull docker.io/falcosecurity/falco-no-driver:0.36.1`
`docker pull docker.io/falcosecurity/falco-distroless:0.36.1`

v0.36.1

Released on 2024-01-30

Major Changes

feat(userspace): remove experimental outputs queue recovery strategies [#2863] - @incertum

Bug Fixes

fix(userspace/falco): timer_delete() workaround due to bug in older GLIBC [#2851] - @incertum

Non user-facing changes

new(docs): add changelog for 0.36.1 [#2872] - @Andreagit97

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	2
Total	3

Release Manager @Andreagit97

0.36.1-rc1

7 months ago

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.36.1-rc1`
`docker pull public.ecr.aws/falcosecurity/falco:0.36.1-rc1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.36.1-rc1`
`docker pull docker.io/falcosecurity/falco-no-driver:0.36.1-rc1`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.36.1-rc1`
`docker pull docker.io/falcosecurity/falco-distroless:0.36.1-rc1`

Release Candidate for Falco 0.36.1. To see what's included, check the corresponding milestone: https://github.com/falcosecurity/falco/milestone/35

0.36.0

8 months ago

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.36.0`
`docker pull public.ecr.aws/falcosecurity/falco:0.36.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.36.0`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.36.0`
`docker pull docker.io/falcosecurity/falco-no-driver:0.36.0`
`docker pull docker.io/falcosecurity/falco-distroless:0.36.0`

v0.36.0

Released on 2023-09-26

Breaking Changes :warning:

The default rules file that is shipped in the Falco image and/or can be downloaded via falcoctl as falco-rules is now a stable rule file. This file contains a much smaller number of rules that are less noisy and have been vetted by the community. This serves as a much requested "starter" Falco rule set that covers many common use case. The rest of that file has been expanded and split into falco-incubating-rules and falco-sandbox-rules. For more information, see the rules repository
The main falcosecurity/falco container image and its falco-driver-loader counterpart have been upgraded. Now they are able to compile the kernel module or classic eBPF probe for relatively newer version of the kernel (5.x and above) while we no longer ship toolchains to compile the kernel module for older versions in the default images. Downloading of prebuilt drivers and the modern eBPF will work exactly like before. The older image, meant for compatibility with older kernels (4.x and below), is currently retained as falcosecurity/falco-driver-loader-legacy.
The Falco HTTP output no longer logs to stdout by default for performance reasons. You can set stdout logging preferences and restore the previous behavior with the configuration option http_output.echo in falco.yaml.
The --list-syscall-events command line option has been replaced by --list-events which prints all supported system events (syscall, tracepoints, metaevents, internal plugin events) in addition to extra information about flags.
The semantics of proc.exepath have changed. Now that field contains the executable path on disk even if the binary was launched from a symbolic link.
The -d daemonize option has been removed.
The stats command line option (-s, --stats-interval) has been removed in favor of metrics configs in falco.yaml
The -p option is now changed:
- when only -pc is set Falco will print container_id=%container.id container_image=%container.image.repository container_image_tag=%container.image.tag container_name=%container.name
- when -pk is set it will print as above, but with k8s_ns=%k8s.ns.name k8s_pod_name=%k8s.pod.name appended

Major Changes

new(falco-driver-loader): --source-only now prints the values as env vars [#2353] - @steakunderscore
new(docker): allow passing options to falco-driver-loader from the driver loader cointainer [#2781] - @LucaGuerra
new(docker): add experimental falco-distroless image based on Wolfi [#2768] - @LucaGuerra
new: the legacy falco image is available as driver-loader-legacy [#2718] - @LucaGuerra
new: added option to enable/disable echoing of server answer to stdout (disabled by default) when using HTTP output [#2602] - @FedeDP
new: support systemctl reload for Falco services [#2588] - @jabdr
new(falco/config): add new configurations for http_output that allow mTLS [#2633] - @annadorottya
new: allow falco to match multiple rules on same event [#2705] - @loresuso

Minor Changes

update(cmake): bumped bundled falcoctl to 0.6.2 [#2829] - @FedeDP
update(rules)!: major rule update to version 2.0.0 [#2823] - @LucaGuerra
update(cmake): bumped plugins to latest stable versions [#2820] - @FedeDP
update(cmake): bumped libs to 0.13.0-rc2 and driver to 6.0.1+driver [#2806] - @FedeDP
update!: default substitution for %container.info is now equal container_id=%container.id container_name=%container.name [#2793] - @leogr
update!: the --list-syscall-events flag is now called --list-events and lists all events [#2771] - @LucaGuerra
update!: the Falco base image is now based on Debian 12 with gcc 11-12 [#2718] - @LucaGuerra
update(docker): the Falco no-driver image is now based on Debian 12 [#2782] - @LucaGuerra
feat(userspace)!: remove -d daemonize option [#2677] - @incertum
build(deps): Bump submodules/falcosecurity-rules from 3f52480 to 0d0e333 [#2693] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from 3f52480 to b42893a [#2756] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from b42893a to 6ed73fe [#2780] - @dependabot[bot]
update(cmake): bumped libs to 0.13.0-rc1 and driver to 6.0.0+driver. [#2783] - @FedeDP
feat: support parsing of system environment variables in yaml [#2562] - @therealdwright
feat(userspace)!: deprecate stats command args option in favor of metrics configs in falco.yaml [#2739] - @incertum
update: upgrade falcoctl to version 0.6.0 [#2764] - @leogr
cleanup: deprecate rate limiter mechanism [#2762] - @Andreagit97
cleanup(config): add more info [#2758] - @incertum
update(userspace/engine): improve skip-if-unknown-filter YAML field [#2749] - @jasondellaluce
chore: improved HTTP output performance [#2602] - @FedeDP
update!: HTTP output will no more echo to stdout by default [#2602] - @FedeDP
chore: remove b64 from falco dependencies [#2746] - @Andreagit97
update(cmake): support building libs and driver from forks [#2747] - @jasondellaluce
update: -p presets have been updated to reflect the new rules style guide [#2737] - @leogr
feat: Allow specifying explicit kernel release and version for falco-driver-loader [#2728] - @johananl
cleanup(config): assign Stable to base_syscalls config [#2740] - @incertum
update : support build for wasm [#2663] - @Rohith-Raju
docs(config.yaml): fix wrong severity levels for sinsp logger [#2736] - @Andreagit97
update(cmake): bump libs and driver to 0.12.0 [#2721] - @jasondellaluce

Bug Fixes

fix(outputs): expose queue_capacity_outputs config for memory control [#2711] - @incertum
fix(userspace/falco): cleanup metrics timer upon leaving. [#2759] - @FedeDP
fix: restore Falco MINIMAL_BUILD and deprecate userspace option [#2761] - @Andreagit97
fix(userspace/engine): support appending to unknown sources [#2753] - @jasondellaluce

Non user-facing changes

build(deps): Bump submodules/falcosecurity-rules from 69c9be8 to 77ba57a [#2833] - @dependabot[bot]
chore: bump submodule testing to 62edc65 [#2831] - @Andreagit97
update(gha): add version for rn2md [#2830] - @LucaGuerra
chore: automatically attach release author to release body. [#2828] - @FedeDP
new(ci): autogenerate release body. [#2812] - @FedeDP
fix(dockerfile): remove useless CMD [#2824] - @Andreagit97
chore: bump to the latest libs [#2822] - @Andreagit97
update: add SPDX license identifier [#2809] - @leogr
chore: bump to latest libs [#2815] - @Andreagit97
build(deps): Bump submodules/falcosecurity-rules from ee5fb38 to bea364e [#2814] - @dependabot[bot]
fix(build): set the right bucket and version for driver legacy [#2800] - @LucaGuerra
build(deps): Bump submodules/falcosecurity-rules from 43580b4 to ee5fb38 [#2810] - @dependabot[bot]
cleanup(userspace): thrown exceptions and avoid multiple logs [#2803] - @Andreagit97
build(deps): Bump submodules/falcosecurity-rules from c6e01fa to 43580b4 [#2801] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-testing from 76d1743 to 30c3643 [#2802] - @dependabot[bot]
fix(userspace/falco): clearing full output queue [#2798] - @jasondellaluce
update(docs): add driver-loader-legacy to readme and fix bad c&p [#2799] - @LucaGuerra
build(deps): Bump submodules/falcosecurity-rules from d31dbc2 to c6e01fa [#2797] - @dependabot[bot]
docs: add LICENSE file [#2796] - @leogr
build(deps): Bump submodules/falcosecurity-rules from b6372d2 to d31dbc2 [#2794] - @dependabot[bot]
fix(stats): always initialize m_output field [#2789] - @Andreagit97
build(deps): Bump submodules/falcosecurity-rules from 6ed73fe to b6372d2 [#2786] - @dependabot[bot]
update(cmake/modules): bump rules to falco-rules-2.0.0-rc1 [#2775] - @leogr
update(OWNERS): add LucaGuerra to owners [#2650] - @LucaGuerra
build(deps): Bump submodules/falcosecurity-rules from 9126bef to 0328c59 [#2709] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from 0d0e333 to 64ce419 [#2731] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from 3ceea88 to 40a9817 [#2745] - @dependabot[bot]
docs(README.md): correct URL [#2772] - @vjjmiras
#2393 Document why Falco is written in C++ rather than anything else [#2410] - @RichardoC
chore: bump Falco to latest libs [#2769] - @Andreagit97
ci: disable falco-driver-loader tests on ARM64 [#2770] - @Andreagit97
update(userspace/falco): revised CLI help messages [#2755] - @leogr
fix(engine): fix reorder warning for m_watch_config_files / m_rule_matching [#2767] - @LucaGuerra
update: introduce new stats updated to the latest libs version [#2766] - @Andreagit97
ci: support tests on amazon-linux [#2765] - @Andreagit97
chore: bump Falco to latest libs master [#2754] - @Andreagit97
build(deps): Bump submodules/falcosecurity-testing from b39c807 to 9110022 [#2760] - @dependabot[bot]
fix: fix "ebpf_enabled" output stat [#2751] - @Andreagit97
fix(userspace/engine): support both old and new gcc + std::move [#2748] - @jasondellaluce
cleanup: turn some warnings into errors [#2744] - @Andreagit97
update(ci): minimize retention days for build-only CI artifacts [#2743] - @jasondellaluce
cleanup: remove unused --pidfile option from systemd units [#2742] - @Andreagit97
build(deps): Bump submodules/falcosecurity-rules from bf1639a to 3ceea88 [#2741] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from 64ce419 to bf1639a [#2738] - @dependabot[bot]
Relocate tools on Flatcar in BPF mode [#2729] - @johananl
build: update versioning with cmake [#2727] - @leogr
update(userspace/engine): make rule_matching strategy stateless [#2726] - @loresuso
chore: bump Falco to latest libs version [#2722] - @Andreagit97

Statistics

MERGED PRS	NUMBER
Not user-facing	48
Release note	38
Total	86

Release Manager @LucaGuerra

0.36.0-rc3

8 months ago

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.36.0-rc3`
`docker pull public.ecr.aws/falcosecurity/falco:0.36.0-rc3`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.36.0-rc3`
`docker pull docker.io/falcosecurity/falco-no-driver:0.36.0-rc3`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.36.0-rc3`
`docker pull docker.io/falcosecurity/falco-distroless:0.36.0-rc3`

Release Candidate for Falco 0.36.0. To see what's included, check the corresponding milestone: https://github.com/falcosecurity/falco/milestone/30

0.36.0-rc2

8 months ago

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.36.0-rc2`
`docker pull public.ecr.aws/falcosecurity/falco:0.36.0-rc2`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.36.0-rc2`
`docker pull docker.io/falcosecurity/falco-no-driver:0.36.0-rc2`

Second Release Candidate for Falco 0.36.0. To see what's included, check the corresponding milestone: https://github.com/falcosecurity/falco/milestone/30

0.36.0-rc1

8 months ago

First Release Candidate for Falco 0.36.0. To see what's included, check the corresponding milestone: https://github.com/falcosecurity/falco/milestone/30

0.35.1

11 months ago

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.35.1`
`docker pull public.ecr.aws/falcosecurity/falco:0.35.1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.35.1`
`docker pull docker.io/falcosecurity/falco-no-driver:0.35.1`

Major Changes

Minor Changes

update(userspace): change description of snaplen option stating only performance implications [#2634] - @loresuso
update(cmake): bump libs to 0.11.3 [#2662] - @jasondellaluce
cleanup(config): minor config clarifications [#2651] - @incertum
update(cmake): bump falco rules to v1.0.1 [#2648] - @jasondellaluce
chore(userspace/falco): make source matching error more expressive [#2623] - @jasondellaluce
update(.github): integrate Go regression tests [#2437] - @jasondellaluce

Bug Fixes

fix(scripts): fixed falco-driver-loader to manage debian kernel rt and cloud flavors. [#2627] - @FedeDP
fix(userspace/falco): solve live multi-source issues when loading more than two sources [#2653] - @jasondellaluce
fix(driver-loader): fix ubuntu kernel version parsing [#2635] - @therealbobo
fix(userspace): switch to timer_settime API for stats writer. [#2646] - @FedeDP

Non user-facing changes

CI: bump ubuntu version for tests-driver-loader-integration job [#2661] - @Andreagit97

Release Manager @jasondellaluce

0.35.0

11 months ago

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.35.0`
`docker pull public.ecr.aws/falcosecurity/falco:0.35.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.35.0`
`docker pull docker.io/falcosecurity/falco-no-driver:0.35.0`

Major Changes

BREAKING CHANGE: support for metadata enrichment from Mesos has been removed. [#2465] - @leogr
new(falco): introduce new metrics w/ Falco internal: metrics snapshot option and new metrics config [#2333] - @incertum
new(scripts): properly manage talos prebuilt drivers [#2537] - @FedeDP
new(release): released container images are now signed with cosign [#2546] - @LucaGuerra
new(ci): ported master and release artifacts publishing CI to gha [#2501] - @FedeDP
new(app_actions): introduce base_syscalls user option [#2428] - @incertum
new(falco/config): add new configurations for http_output that allow custom CA certificates and stores. [#2458] - @alacuku
new(cmake): bumped libs to c8b0d6a8fdc1bb3ea9067bc2fdc3ae5858cff48f [#2456] - @FedeDP
new(userspace): add a new syscall_drop_failed config option to drop failed syscalls exit events [#2456] - @FedeDP

Minor Changes

update(cmake): bump Falco rules to 1.0.0 [#2618] - @loresuso
update(cmake): bump libs to 0.11.1 [#2614] - @loresuso
update(cmake): bump plugins to latest versions [#2610] - @loresuso
update(cmake): bump falco rules to 1.0.0-rc1 [#2609] - @loresuso
update(cmake): bump libs to 0.11.0 [#2608] - @loresuso
cleanup(docs): update release.md [#2599] - @incertum
update(cmake): bump libs to 0.11.0-rc5 and driver to 5.0.1. [#2600] - @FedeDP
cleanup(docs): adjust falco readme style and content [#2594] - @incertum
cleanup(userspace, config): improve metrics UX, add include_empty_values option [#2593] - @incertum
feat: add the curl and jq packages to the falco-no-driver docker image [#2581] - @therealdwright
update: add missing exception, required_engine_version, required_plugin_version to -L json output [#2584] - @loresuso
feat: add image source OCI label to docker images [#2592] - @therealdwright
cleanup(config): improve falco config [#2571] - @incertum
update(cmake): bump libs and plugins to latest dev versions [#2586] - @jasondellaluce
chore(userspace/falco): always print invalid syscalls from custom set [#2578] - @jasondellaluce
update(build): upgrade falcoctl to 0.5.0 [#2572] - @LucaGuerra
chore(userspace/falco/app): print all supported plugin caps [#2564] - @jasondellaluce
update: get rules details with -l or -L flags when json output format is specified [#2544] - @loresuso
update!: bump libs version, and support latest plugin features, add --nodriver option [#2552] - @jasondellaluce
cleanup(actions): now modern bpf support -A flag [#2551] - @Andreagit97
update: falco-driver-loader now uses now uses $TMPDIR if set [#2518] - @jabdr
update: improve control and UX of ignored events [#2509] - @jasondellaluce
update: bump libs and adapt Falco to new libsinsp event source management [#2507] - @jasondellaluce
new(app_actions)!: adjust base_syscalls option, add base_syscalls.repair [#2457] - @incertum
update(scripts): support al2022 and al2023 in falco-driver-loader. [#2494] - @FedeDP
update: sync libs with newest event name APIs [#2471] - @jasondellaluce
update!: remove --mesos-api, -pmesos, and -pm command-line flags [#2465] - @leogr
cleanup(unit_tests): try making test_configure_interesting_sets more robust [#2464] - @incertum

Bug Fixes

fix: unquote quoted URL's to avoid libcurl errors [#2596] - @therealdwright
fix(userspace/engine): store alternatives as array in -L json output [#2597] - @loresuso
fix(userspace/engine): store required engine version as string in -L json output [#2595] - @loresuso
fix(userspace/falco): report plugin deps rules issues in any case [#2589] - @jasondellaluce
fix(userspace): hotreload on wrong metrics [#2582] - @therealbobo
fix(userspace): check the supported number of online CPUs with modern bpf [#2575] - @Andreagit97
fix(userspace/falco): don't hang on terminating error when multi sourcing [#2576] - @jasondellaluce
fix(userspace/falco): properly format numeric values in metrics [#2569] - @jasondellaluce
fix(scripts): properly support debian kernel releases embedded in kernel version [#2377] - @FedeDP

Non user-facing changes

docs(README.md): add scope/status badge and simply doc structure [#2611] - @leogr
build(deps): Bump submodules/falcosecurity-rules from 3471984 to 16fb709 [#2598] - @dependabot[bot]
docs(proposals): Falco roadmap management [#2547] - @leogr
build(deps): Bump submodules/falcosecurity-rules from b2290ad to 3471984 [#2577] - @dependabot[bot]
update(build): libs 0.11.0-rc2 [#2573] - @LucaGuerra
build(deps): Bump submodules/falcosecurity-rules from 3f52480 to b2290ad [#2570] - @dependabot[bot]
update(ci): use repo instead of master branch for reusable workflows [#2568] - @LucaGuerra
cleanup(ci): cleaned up circleci workflow. [#2566] - @FedeDP
build(deps): Bump requests from 2.26.0 to 2.31.0 in /test [#2567] - @dependabot[bot]
fix(ci): simplify and fix multi-arch image publishing process [#2542] - @LucaGuerra
fix(ci): get the manifest for the correct tag [#2563] - @LucaGuerra
build(deps): Bump submodules/falcosecurity-rules from 3f52480 to 6da15ae [#2559] - @dependabot[bot]
fix(ci): properly use docker save to store images. [#2560] - @FedeDP
fix(ci): docker arg is named TARGETARCH. [#2558] - @FedeDP
fix(ci): set docker TARGET_ARCH [#2557] - @FedeDP
fix(ci): use normal docker to build docker images, instead of buildx. [#2556] - @FedeDP
docs: improve documentation and description of base_syscalls option [#2515] - @Happy-Dude
Updating Falco branding guidelines [#2493] - @aijamalnk
build(deps): Bump submodules/falcosecurity-rules from f773578 to 6da15ae [#2553] - @dependabot[bot]
fix(cmake): properly exclude prereleases when fetching latest tag from cmake [#2550] - @FedeDP
fix(ci): load falco image before building falco-driver-loader [#2549] - @LucaGuerra
fix(ci): correctly tag slim manifest [#2545] - @LucaGuerra
cleanup(config): modern bpf is no more experimental [#2538] - @Andreagit97
new(ci): add RC/prerelease support [#2533] - @LucaGuerra
fix(ci): configure ECR public region [#2531] - @LucaGuerra
fix(ci): falco images directory, ecr login [#2528] - @LucaGuerra
fix(ci): separate rpm/bin/bin-static/deb packages before publication, rename bin-static [#2527] - @LucaGuerra
fix(ci): add Cloudfront Distribution ID [#2525] - @LucaGuerra
fix(ci): escape heredoc [#2521] - @LucaGuerra
chore(ci): build-musl-package does not need to wait for build-packages anymore [#2520] - @FedeDP
fix: ci Falco version [#2516] - @FedeDP
fix(ci): fetch version step, download rpms/debs, minor change [#2519] - @LucaGuerra
chore(ci): properly install recent version of git (needed >= 2.18 by checkout action) [#2514] - @FedeDP
fix(ci): enable toolset before every make command [#2513] - @LucaGuerra
fix(ci): remove unnecessary mv [#2512] - @LucaGuerra
fix(ci): bucket -> bucket_suffix [#2511] - @LucaGuerra
build(deps): Bump submodules/falcosecurity-rules from 5857874 to 1bd7e4a [#2478] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from 694adf5 to 5857874 [#2473] - @dependabot[bot]
cleanup(ci): properly set a concurrency for CI workflows. [#2470] - @FedeDP
build(deps): Bump submodules/falcosecurity-rules from e0646a0 to 694adf5 [#2466] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from 0b0f50f to e0646a0 [#2460] - @dependabot[bot]

Release Manager @FedeDP

0.35.0-rc2

11 months ago

Release Candidate for Falco 0.35.0

0.35.0-rc1

11 months ago

Release Candidate for Falco 0.35.0