5068 Commits

Author SHA1 Message Date
Paolo Polidori
865284dffe fix(webserver): fix inconsistent include directives trying to compile the webserver on Apple
Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
2026-02-19 11:54:55 +01:00
dependabot[bot]
514470abd1 chore(deps): Bump submodules/falcosecurity-rules
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `72cc635` to `6f43d74`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](72cc635100...6f43d7492d)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-version: 6f43d7492d9543b1faa9d8347a5692b21082272f
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-02-17 09:55:40 +01:00
irozzo-1A
b511b54d21 chore(build): add support for gperftools CPU profiler
Add comprehensive support for gperftools CPU profiler to enable performance
profiling of Falco. This commit introduces:

- New CMake options:
  * USE_GPERFTOOLS: Enable gperftools CPU profiler support (default: OFF)
  * USE_FRAME_POINTER: Enable frame pointers for accurate profiling (default: OFF)

- Automatic frame pointer enabling: When USE_GPERFTOOLS is enabled, frame
  pointers are automatically enabled to ensure accurate stack traces in
  profiling output.

- Support for both system and bundled gperftools:
  * System gperftools: Automatically detected via find_path/find_library
  * Bundled gperftools: Built from source (version 2.15) when
    USE_BUNDLED_GPERFTOOLS is enabled

- Enhanced stack trace support: Automatically detects and enables libunwind
  when available for better stack traces, falling back to frame pointers
  otherwise.

- Proper library linking: Uses --whole-archive linker flags to ensure
  profiler initialization code is linked even when ProfilerStart() is not
  called directly, enabling CPUPROFILE environment variable support.

- Compile-time detection: Adds HAS_GPERFTOOLS preprocessor definition
  for conditional compilation.

The profiler can be activated at runtime by setting the CPUPROFILE
environment variable to a file path where profiling data should be written.

Usage:
  cmake -DUSE_GPERFTOOLS=ON ..
  make
  CPUPROFILE=/tmp/falco.prof ./falco

Signed-off-by: irozzo-1A <iacopo@sysdig.com>
2026-02-12 11:32:11 +01:00
Leonardo Di Giovanna
43aaffc4e0 chore!: drop gRPC output and server support
Falco 0.43.0 deprecated the gRPC output and server supports. Drop
their supports as well as any reference to them.

BREAKING CHANGE: drop gRPC output and server support

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-02-05 17:21:54 +01:00
Leonardo Di Giovanna
33a2ce53fd chore!: drop gVisor engine support
Falco 0.43.0 deprecated the gVisor engine support. Drop its support as
well as any reference to it.

BREAKING CHANGE: drop gVisor engine support

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-02-05 15:29:54 +01:00
Leonardo Di Giovanna
387499546f chore!: drop legacy BPF probe
Falco 0.43.0 deprecated the legacy eBPF probe. Drop it as well as any
reference to it.

BREAKING CHANGE: drop legacy eBPF probe

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-02-05 13:15:54 +01:00
Leonardo Grasso
ae9c2fbbc3 revert: "chore(.github): put back temporary action for GPG key roation"
This reverts commit abcc058605.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-29 09:25:20 +01:00
Leonardo Di Giovanna
89975f1af8 docs: update CHANGELOG.md to Falco 0.43.0
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-28 16:52:14 +01:00
Leonardo Di Giovanna
b9b526e493 chore(cmake): bump falcoctl dependency version to 0.12.2
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-28 12:14:12 +01:00
Leonardo Grasso
cca5356911 fix(userspace)!: show source config path only in debug builds
Starting from Falco 0.40, the `falco --help` output incorrectly showed
  the source config path (e.g., /home/runner/work/falco/falco/falco.yaml)
  in release packages. This path was intended only for local development.

  The issue was introduced when RelWithDebInfo build type support was
  added (commit 6bf33ffd). The existing code checked for BUILD_TYPE_RELEASE
  to determine release behavior, but RelWithDebInfo builds defined
  BUILD_TYPE_RELWITHDEBINFO instead, causing them to fall into the
  debug code path.

  This fix introduces BUILD_TYPE_DEBUG and changes the conditionals to
  enable dev features only when CMAKE_BUILD_TYPE is explicitly "debug".
  Both Release and RelWithDebInfo builds now correctly show only
  /etc/falco/falco.yaml.

  Fixes the regression introduced in 0.40.0

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-23 15:39:47 +01:00
Leonardo Di Giovanna
d0b6c138f9 docs: add deprecation notice for legacy eBPF in pkg install dialog
DEPRECATION NOTICE: add deprecation notice for legacy eBPF in pkg
  install dialog

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-23 14:14:47 +01:00
Leonardo Di Giovanna
bb8f6fa136 chore(userspace): deprecate --gvisor-generate-config CLI option
DEPRECATION NOTICE: deprecate `--gvisor-generate-config` CLI option

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-23 12:08:46 +01:00
Leonardo Di Giovanna
9d55804371 chore(cmake): bump container plugin version to 0.6.1
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-22 10:58:39 +01:00
Leonardo Di Giovanna
5baf13b80a chore(cmake): bump falcoctl dependency version to 0.12.1
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-22 10:57:38 +01:00
Leonardo Grasso
69581443ae fix(userspace/engine): missing closing quote in deprecated field warning
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-21 16:16:32 +01:00
cannarelladev
9324799b1a fix: add update_repo to publish-rpm script
Signed-off-by: cannarelladev <cannarella.dev@gmail.com>
2026-01-19 18:58:18 +01:00
irozzo-1A
aad403f9d3 docs(OWNERS): add irozzo-1A(Iacopo Rozzo) as reviewer
Signed-off-by: irozzo-1A <iacopo@sysdig.com>
2026-01-19 18:16:18 +01:00
Leonardo Grasso
929b27b897 fix: consolidate RPM signing logic into publish-rpm
Co-authored-by: irozzo-1A <iacopo@sysdig.com>
Co-authored-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-19 16:36:17 +01:00
irozzo-1A
abcc058605 chore(.github): put back temporary action for GPG key roation
This reverts commit c93a6a8bd9.

Signed-off-by: irozzo-1A <iacopo@sysdig.com>
2026-01-19 16:36:17 +01:00
Leonardo Di Giovanna
40fda7a874 docs(proposals): specify version enforcing the deprecation
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-14 16:42:58 +01:00
Leonardo Di Giovanna
da8644b73e chore(cmake): bump libs/drivers to 0.23.1/9.1.0+driver
The previously used driver version was already the `9.1.0+driver`:
simply replace the commit SHA with the release name.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
0.43.0-rc1
2026-01-14 14:27:57 +01:00
Leonardo Grasso
c93a6a8bd9 revert: chore(.github): temporary action for GPG key roation
This reverts commit edcb7a5dca.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-14 12:05:56 +01:00
irozzo-1A
c72a8151e5 chore(cmake): bump container plugin version to 0.6.0
Signed-off-by: irozzo-1A <iacopo@sysdig.com>
2026-01-14 11:19:56 +01:00
Leonardo Grasso
edcb7a5dca chore(.github): temporary action for GPG key roation
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-12 17:10:44 +01:00
Kevin Vu
3dabda4b7d fix: prevent NULL pointer crash in program_output on popen failure
Signed-off-by: Kevin Vu <vietcgi@gmail.com>
2026-01-12 09:31:44 +01:00
Leonardo Grasso
2ddcb51ebf fix(docker/falco-debian/Dockerfile): remove extra blank line
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-09 12:51:23 +01:00
Leonardo Grasso
8009d71bb2 chore(docker/driver-loader-buster): align to other Dockerfiles
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-09 12:51:23 +01:00
Leonardo Grasso
e7a68bde45 chore(docker/driver-loader-buster): align to other Dockerfiles
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-09 12:51:23 +01:00
Leonardo Grasso
3d603af362 chore(docker/driver-loader-buster): align to other Dockerfiles
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-09 12:51:23 +01:00
Leonardo Grasso
ab5a1fc1ea chore(docker/falco-debian): clean up ENV var
Co-authored-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-09 12:51:23 +01:00
Leonardo Grasso
66555b9f4a chore(docker/falco/Dockerfile): cleanup comment
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2026-01-09 12:51:23 +01:00
Raul Leite
b463f30ff9 Update docker/falco/Dockerfile
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Raul Leite <sp4wn.root@gmail.com>
2026-01-09 12:51:23 +01:00
Raul Leite
2d06fa0963 Update docker/falco-debian/Dockerfile
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Raul Leite <sp4wn.root@gmail.com>
2026-01-09 12:51:23 +01:00
Raul Leite
697a807b55 Restored FALCO_VERSION_URLENCODED as noted
Signed-off-by: Raul Leite <sp4wn.root@gmail.com>
2026-01-09 12:51:23 +01:00
Raul Leite
9616b6945d Fixed ARGS and ./config to config fqdn path
Signed-off-by: Raul Leite <sp4wn.root@gmail.com>
2026-01-09 12:51:23 +01:00
Raul Leite
879455453d Improved ENV Variable falco/diver-loader-buster/Dockerfile
Signed-off-by: Raul Leite <sp4wn.root@gmail.com>
2026-01-09 12:51:23 +01:00
Raul Leite
600a256f1f Improved ENV Variable falco/Dockerfile
Signed-off-by: Raul Leite <sp4wn.root@gmail.com>
2026-01-09 12:51:23 +01:00
Raul Leite
0c039bc163 Removed ca-certificates duplicity; Improved ENV Variable
Signed-off-by: Raul Leite <sp4wn.root@gmail.com>
2026-01-09 12:51:23 +01:00
Leonardo Di Giovanna
8b01753f6e chore(userspace): deprecate legacy eBPF probe, gVisor engine and gRPC
DEPRECATION NOTICE: deprecate legacy eBPF, gVisor and gRPC

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-08 15:50:17 +01:00
Leonardo Di Giovanna
d41a95ab11 docs: add deprecation notice for legacy eBPF, gVisor and gRPC usage
DEPRECATION NOTICE: add notice for legacy eBPF, gVisor and gRPC

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-08 15:50:17 +01:00
Leonardo Di Giovanna
48c7bc78b6 docs(proposals): add proposal for legacy probe, gVisor engine and gRPC output deprecation
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2026-01-08 12:04:17 +01:00
poiana
50d4c4c879 update(cmake): update libs and driver to latest master.
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-01-07 14:39:12 +01:00
Leonardo Di Giovanna
e34a6b28eb chore(cmake): bump libs/drivers to 0.23.0/9.1.0+driver
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2025-12-24 09:36:41 +01:00
Adnan Ali
f4df5681fd fix(metrics): Add null check for state.outputs in metrics collection
This change adds a defensive null check before accessing state.outputs->get_outputs_queue_num_drops() to prevent segfaults if outputs is destroyed while metrics are being collected.

Signed-off-by: Adnan Ali <adduali1310@hotmail.com>
2025-12-23 15:18:38 +01:00
Leonardo Di Giovanna
fd4609884a chore(cmake): bump libs to 0.23.0-rc2
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2025-12-23 10:46:38 +01:00
Leonardo Di Giovanna
817551ee25 chore(cmake): bump libs/drivers to 0.23.0-rc1/9.1.0-rc1+driver
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2025-12-19 14:58:17 +01:00
Leonardo Grasso
6a152d338b chore(scripts/falcoctl): increase follow interval to 1 week
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-12-18 18:27:12 +01:00
irozzo-1A
11e8f82c6c Revert "fix(.github): ghcr.io rate-limit mitigation"
This reverts commit 2d9f1f1abc.

Signed-off-by: irozzo-1A <iacopo@sysdig.com>
2025-12-12 13:08:39 +01:00
irozzo-1A
03adda8656 Revert "chore(build): attempt mitigation to rate-limiter issuo on ghcr.io"
This reverts commit a9e8063e58.

Signed-off-by: irozzo-1A <iacopo@sysdig.com>
2025-12-12 13:08:39 +01:00
poiana
1582018a2c update(cmake): update libs and driver to latest master.
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2025-12-12 11:07:38 +01:00