update(cmake): bump plugins to latest dev versions

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
fix(userspace/engine): don't count async event for evttype warning
2026-03-25 06:02:18 +00:00 · 2023-05-19 12:15:04 +02:00 · 2023-05-19 12:15:04 +02:00 · 2023-05-19 12:15:04 +02:00 · 2023-05-19 12:15:04 +02:00 · 2023-05-19 12:15:04 +02:00
46 changed files with 1489 additions and 528 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -39,7 +39,8 @@ jobs:
      - run:
          name: Build Falco packages 🏗️
          command: |
-            DOCKER_BUILDKIT=1 docker build -f /tmp/source-arm64/falco/docker/builder/modern-falco-builder.Dockerfile --output type=local,dest=/tmp --build-arg CMAKE_OPTIONS="-DCMAKE_BUILD_TYPE=Release -DUSE_BUNDLED_DEPS=On -DFALCO_ETC_DIR=/etc/falco -DBUILD_FALCO_MODERN_BPF=ON -DMODERN_BPF_SKEL_DIR=/source/skeleton-build/skel_dir -DBUILD_DRIVER=Off -DBUILD_BPF=Off" --build-arg DEST_BUILD_DIR=/build-arm64/release /tmp/source-arm64/falco
+            FALCO_VERSION=$(cat /tmp/source-arm64/falco/skeleton-build/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
+            DOCKER_BUILDKIT=1 docker build -f /tmp/source-arm64/falco/docker/builder/modern-falco-builder.Dockerfile --output type=local,dest=/tmp --build-arg CMAKE_OPTIONS="-DCMAKE_BUILD_TYPE=Release -DUSE_BUNDLED_DEPS=On -DFALCO_ETC_DIR=/etc/falco -DBUILD_FALCO_MODERN_BPF=ON -DMODERN_BPF_SKEL_DIR=/source/skeleton-build/skel_dir -DBUILD_DRIVER=Off -DBUILD_BPF=Off -DFALCO_VERSION=${FALCO_VERSION}" --build-arg DEST_BUILD_DIR=/build-arm64/release /tmp/source-arm64/falco

      - store_artifacts:
          path: /tmp/packages
@@ -135,7 +136,8 @@ jobs:
      - run:
          name: Build Falco packages 🏗️
          command: |
-            DOCKER_BUILDKIT=1 docker build -f /tmp/source/falco/docker/builder/modern-falco-builder.Dockerfile --output type=local,dest=/tmp --build-arg CMAKE_OPTIONS="-DCMAKE_BUILD_TYPE=Release -DUSE_BUNDLED_DEPS=On -DFALCO_ETC_DIR=/etc/falco -DBUILD_FALCO_MODERN_BPF=ON -DMODERN_BPF_SKEL_DIR=/source/skeleton-build/skel_dir -DBUILD_DRIVER=Off -DBUILD_BPF=Off" --build-arg DEST_BUILD_DIR=/build/release /tmp/source/falco
+            FALCO_VERSION=$(cat /tmp/source/falco/skeleton-build/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
+            DOCKER_BUILDKIT=1 docker build -f /tmp/source/falco/docker/builder/modern-falco-builder.Dockerfile --output type=local,dest=/tmp --build-arg CMAKE_OPTIONS="-DCMAKE_BUILD_TYPE=Release -DUSE_BUNDLED_DEPS=On -DFALCO_ETC_DIR=/etc/falco -DBUILD_FALCO_MODERN_BPF=ON -DMODERN_BPF_SKEL_DIR=/source/skeleton-build/skel_dir -DBUILD_DRIVER=Off -DBUILD_BPF=Off -DFALCO_VERSION=${FALCO_VERSION}" --build-arg DEST_BUILD_DIR=/build/release /tmp/source/falco

      - store_artifacts:
          path: /tmp/packages
@@ -755,78 +757,78 @@ workflows:
      - "tests-driver-loader-integration":
          requires:
            - "build-centos7"
-      - "rpm-sign":
-          context: falco
-          filters:
-            tags:
-              ignore: /.*/
-            branches:
-              only: master
-          requires:
-            - "tests-integration"
-            - "tests-integration-arm64"
-      - "publish-packages-dev":
-          context:
-            - falco
-            - test-infra
-          filters:
-            tags:
-              ignore: /.*/
-            branches:
-              only: master
-          requires:
-            - "rpm-sign"
-            - "tests-integration-static"
-      - "publish-packages-deb-dev":
-          context:
-            - falco
-            - test-infra
-          filters:
-            tags:
-              ignore: /.*/
-            branches:
-              only: master
-          requires:
-            - "tests-integration"
-            - "tests-integration-arm64"
-      - "build-docker-dev":
-          context:
-            - falco
-            - test-infra
-          filters:
-            tags:
-              ignore: /.*/
-            branches:
-              only: master
-          requires:
-            - "publish-packages-dev"
-            - "publish-packages-deb-dev"
-            - "tests-driver-loader-integration"
-      - "build-docker-dev-arm64":
-          context:
-            - falco
-            - test-infra
-          filters:
-            tags:
-              ignore: /.*/
-            branches:
-              only: master
-          requires:
-            - "publish-packages-dev"
-            - "publish-packages-deb-dev"
-            - "tests-driver-loader-integration"      
-      - "publish-docker-dev":
-          context:
-            - falco
-            - test-infra
-          filters:
-            tags:
-              ignore: /.*/
-            branches:
-              only: master
-          requires:
-            - "build-docker-dev"
-            - "build-docker-dev-arm64"
+      # - "rpm-sign":
+      #     context: falco
+      #     filters:
+      #       tags:
+      #         ignore: /.*/
+      #       branches:
+      #         only: master
+      #     requires:
+      #       - "tests-integration"
+      #       - "tests-integration-arm64"
+      # - "publish-packages-dev":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     filters:
+      #       tags:
+      #         ignore: /.*/
+      #       branches:
+      #         only: master
+      #     requires:
+      #       - "rpm-sign"
+      #       - "tests-integration-static"
+      # - "publish-packages-deb-dev":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     filters:
+      #       tags:
+      #         ignore: /.*/
+      #       branches:
+      #         only: master
+      #     requires:
+      #       - "tests-integration"
+      #       - "tests-integration-arm64"
+      # - "build-docker-dev":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     filters:
+      #       tags:
+      #         ignore: /.*/
+      #       branches:
+      #         only: master
+      #     requires:
+      #       - "publish-packages-dev"
+      #       - "publish-packages-deb-dev"
+      #       - "tests-driver-loader-integration"
+      # - "build-docker-dev-arm64":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     filters:
+      #       tags:
+      #         ignore: /.*/
+      #       branches:
+      #         only: master
+      #     requires:
+      #       - "publish-packages-dev"
+      #       - "publish-packages-deb-dev"
+      #       - "tests-driver-loader-integration"      
+      # - "publish-docker-dev":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     filters:
+      #       tags:
+      #         ignore: /.*/
+      #       branches:
+      #         only: master
+      #     requires:
+      #       - "build-docker-dev"
+      #       - "build-docker-dev-arm64"
      # - "quality/static-analysis" # This is temporarily disabled: https://github.com/falcosecurity/falco/issues/1526
  release:
    jobs:
@@ -848,73 +850,73 @@ workflows:
              only: /.*/
            branches:
              ignore: /.*/
-      - "rpm-sign":
-          context: falco
-          requires:
-            - "build-centos7"
-            - "build-arm64"
-          filters:
-            tags:
-              only: /.*/
-            branches:
-              ignore: /.*/
-      - "publish-packages":
-          context:
-            - falco
-            - test-infra
-          requires:
-            - "build-musl"
-            - "rpm-sign"
-          filters:
-            tags:
-              only: /.*/
-            branches:
-              ignore: /.*/
-      - "publish-packages-deb":
-          context:
-            - falco
-            - test-infra
-          requires:
-            - "build-centos7"
-            - "build-arm64"
-          filters:
-            tags:
-              only: /.*/
-            branches:
-              ignore: /.*/
-      - "build-docker":
-          context:
-            - falco
-            - test-infra
-          requires:
-            - "publish-packages"
-            - "publish-packages-deb"
-          filters:
-            tags:
-              only: /.*/
-            branches:
-              ignore: /.*/
-      - "build-docker-arm64":
-          context:
-            - falco
-            - test-infra
-          requires:
-            - "publish-packages"
-            - "publish-packages-deb"
-          filters:
-            tags:
-              only: /.*/
-            branches:
-              ignore: /.*/
-      - "publish-docker":
-          context:
-            - falco
-            - test-infra
-          requires:
-            - "build-docker"
-            - "build-docker-arm64"
-          filters:
-            tags:
-              only: /.*/
-            branches:
-              ignore: /.*/
+      # - "rpm-sign":
+      #     context: falco
+      #     requires:
+      #       - "build-centos7"
+      #       - "build-arm64"
+      #     filters:
+      #       tags:
+      #         only: /.*/
+      #       branches:
+      #         ignore: /.*/
+      # - "publish-packages":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     requires:
+      #       - "build-musl"
+      #       - "rpm-sign"
+      #     filters:
+      #       tags:
+      #         only: /.*/
+      #       branches:
+      #         ignore: /.*/
+      # - "publish-packages-deb":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     requires:
+      #       - "build-centos7"
+      #       - "build-arm64"
+      #     filters:
+      #       tags:
+      #         only: /.*/
+      #       branches:
+      #         ignore: /.*/
+      # - "build-docker":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     requires:
+      #       - "publish-packages"
+      #       - "publish-packages-deb"
+      #     filters:
+      #       tags:
+      #         only: /.*/
+      #       branches:
+      #         ignore: /.*/
+      # - "build-docker-arm64":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     requires:
+      #       - "publish-packages"
+      #       - "publish-packages-deb"
+      #     filters:
+      #       tags:
+      #         only: /.*/
+      #       branches:
+      #         ignore: /.*/
+      # - "publish-docker":
+      #     context:
+      #       - falco
+      #       - test-infra
+      #     requires:
+      #       - "build-docker"
+      #       - "build-docker-arm64"
+      #     filters:
+      #       tags:
+      #         only: /.*/
+      #       branches:
+      #         ignore: /.*/
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,10 +2,14 @@ name: CI Build
 on:
  pull_request:
    branches: [master]
-  push:
-    branches: [master]
  workflow_dispatch:

+# Checks if any concurrent jobs under the same pull request or branch are being executed
+# NOTE: this will cancel every workflow that is being ran against a PR as group is just the github ref (without the workflow name)
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true  
+
 jobs:
  build-minimal:
    runs-on: ubuntu-20.04
@@ -60,7 +64,7 @@ jobs:
        run: |
          mkdir build
          pushd build
-          cmake -DBUILD_BPF=On -DBUILD_FALCO_UNIT_TESTS=On ..
+          cmake -DBUILD_BPF=On -DCMAKE_BUILD_TYPE=Release -DBUILD_FALCO_UNIT_TESTS=On ..
          popd

      - name: Build
@@ -94,7 +98,7 @@ jobs:
        run: |
          mkdir build
          pushd build
-          cmake -DCMAKE_BUILD_TYPE=debug -DBUILD_BPF=On -DBUILD_FALCO_UNIT_TESTS=On ..
+          cmake -DCMAKE_BUILD_TYPE=Debug -DBUILD_BPF=On -DBUILD_FALCO_UNIT_TESTS=On ..
          popd

      - name: Build
--- a/.github/workflows/master.yaml
+++ b/.github/workflows/master.yaml
@@ -0,0 +1,93 @@
+name: Dev Packages and Docker images
+on:
+  push:
+    branches: [master]
+
+# Checks if any concurrent jobs is running for master CI and eventually cancel it
+concurrency:
+  group: ci-master
+  cancel-in-progress: true  
+
+jobs:
+  # We need to use an ubuntu-latest to fetch Falco version because
+  # Falco version is computed by some cmake scripts that do git sorceries
+  # to get the current version.
+  # But centos7 jobs have a git version too old and actions/checkout does not 
+  # fully clone the repo, but uses http rest api instead.
+  fetch-version:
+    runs-on: ubuntu-latest
+    # Map the job outputs to step outputs
+    outputs:
+      version: ${{ steps.store_version.outputs.version }}  
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          
+      - name: Install build dependencies
+        run: |
+          sudo apt update 
+          sudo apt install -y cmake build-essential
+      
+      - name: Configure project
+        run: |
+          mkdir build && cd build
+          cmake -DUSE_BUNDLED_DEPS=On ..
+          
+      - name: Load and store Falco version output
+        id: store_version
+        run: |
+          FALCO_VERSION=$(cat build/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
+          echo "version=${FALCO_VERSION}" >> $GITHUB_OUTPUT     
+
+  build-dev-packages:
+    needs: [fetch-version]
+    uses: falcosecurity/falco/.github/workflows/reusable_build_packages.yaml@master
+    with:
+      arch: x86_64
+      version: ${{ needs.fetch-version.outputs.version }}
+    secrets: inherit
+  
+  build-dev-packages-arm64:
+    needs: [fetch-version]
+    uses: falcosecurity/falco/.github/workflows/reusable_build_packages.yaml@master
+    with:
+      arch: aarch64
+      version: ${{ needs.fetch-version.outputs.version }}
+    secrets: inherit
+    
+  publish-dev-packages:
+    needs: [fetch-version, build-dev-packages, build-dev-packages-arm64]
+    uses: falcosecurity/falco/.github/workflows/reusable_publish_packages.yaml@master
+    with:
+      bucket_suffix: '-dev'
+      version: ${{ needs.fetch-version.outputs.version }}
+    secrets: inherit
+  
+  build-dev-docker:
+    needs: [fetch-version, publish-dev-packages]
+    uses: falcosecurity/falco/.github/workflows/reusable_build_docker.yaml@master
+    with:
+      arch: x86_64
+      bucket_suffix: '-dev'
+      version: ${{ needs.fetch-version.outputs.version }}
+      tag: master
+    secrets: inherit
+    
+  build-dev-docker-arm64:
+    needs: [fetch-version, publish-dev-packages]
+    uses: falcosecurity/falco/.github/workflows/reusable_build_docker.yaml@master
+    with:
+      arch: aarch64
+      bucket_suffix: '-dev'
+      version: ${{ needs.fetch-version.outputs.version }}
+      tag: master
+    secrets: inherit
+    
+  publish-dev-docker:
+    needs: [fetch-version, build-dev-docker, build-dev-docker-arm64]
+    uses: falcosecurity/falco/.github/workflows/reusable_publish_docker.yaml@master
+    with:
+      tag: master
+    secrets: inherit
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,105 @@
+name: Release Packages and Docker images
+on:
+  release:
+    types: [published]
+
+# Checks if any concurrent jobs is running for release CI and eventually cancel it.
+concurrency:
+  group: ci-release
+  cancel-in-progress: true  
+
+jobs:
+  release-settings:
+    runs-on: ubuntu-latest
+    outputs:
+      is_latest: ${{ steps.get_settings.outputs.is_latest }} 
+      bucket_suffix: ${{ steps.get_settings.outputs.bucket_suffix }}
+    steps:
+      - name: Get latest release
+        uses: rez0n/actions-github-release@v2.0
+        id: latest_release
+        env:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          repository: ${{ github.repository }}
+          type: "stable"
+
+      - name: Get settings for this release
+        id: get_settings
+        shell: python
+        run: |
+          import os
+          import re
+          import sys
+
+          semver_no_meta = '''^(?P<major>0|[1-9]\d*)\.(?P<minor>0|[1-9]\d*)\.(?P<patch>0|[1-9]\d*)(?:-(?P<prerelease>(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?$'''
+          tag_name = '${{ github.event.release.tag_name }}'
+
+          is_valid_version = re.match(semver_no_meta, tag_name) is not None
+          if not is_valid_version:
+            print(f'Release version {tag_name} is not a valid full or pre-release. See RELEASE.md for more information.')
+            sys.exit(1)
+
+          is_prerelease = '-' in tag_name
+
+          # Safeguard: you need to both set "latest" in GH and not have suffixes to overwrite latest
+          is_latest = '${{ steps.latest_release.outputs.release }}' == tag_name and not is_prerelease
+
+          bucket_suffix = '-dev' if is_prerelease else ''
+
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as ofp:
+            print(f'is_latest={is_latest}'.lower(), file=ofp)
+            print(f'bucket_suffix={bucket_suffix}', file=ofp)
+
+  build-packages:
+    needs: [release-settings]
+    uses: falcosecurity/falco/.github/workflows/reusable_build_packages.yaml@master
+    with:
+      arch: x86_64
+      version: ${{ github.event.release.tag_name }}
+    secrets: inherit
+
+  build-packages-arm64:
+    needs: [release-settings]
+    uses: falcosecurity/falco/.github/workflows/reusable_build_packages.yaml@master
+    with:
+      arch: aarch64
+      version: ${{ github.event.release.tag_name }}
+    secrets: inherit
+    
+  publish-packages:
+    needs: [release-settings, build-packages, build-packages-arm64]
+    uses: falcosecurity/falco/.github/workflows/reusable_publish_packages.yaml@master
+    with:
+      bucket_suffix: ${{ needs.release-settings.outputs.bucket_suffix }}
+      version: ${{ github.event.release.tag_name }}
+    secrets: inherit
+  
+  # Both build-docker and its arm64 counterpart require build-packages because they use its output
+  build-docker:
+    needs: [release-settings, build-packages, publish-packages]
+    uses: falcosecurity/falco/.github/workflows/reusable_build_docker.yaml@master
+    with:
+      arch: x86_64
+      bucket_suffix: ${{ needs.release-settings.outputs.bucket_suffix }}
+      version: ${{ github.event.release.tag_name }}
+      tag: ${{ github.event.release.tag_name }}
+    secrets: inherit
+    
+  build-docker-arm64:
+    needs: [release-settings, build-packages, publish-packages]
+    uses: falcosecurity/falco/.github/workflows/reusable_build_docker.yaml@master
+    with:
+      arch: aarch64
+      bucket_suffix: ${{ needs.release-settings.outputs.bucket_suffix }}
+      version: ${{ github.event.release.tag_name }}
+      tag: ${{ github.event.release.tag_name }}
+    secrets: inherit
+
+  publish-docker:
+    needs: [release-settings, build-docker, build-docker-arm64]
+    uses: falcosecurity/falco/.github/workflows/reusable_publish_docker.yaml@master
+    secrets: inherit
+    with:
+      is_latest: ${{ needs.release-settings.outputs.is_latest == 'true' }}
+      tag: ${{ github.event.release.tag_name }}
+      sign: true
--- a/.github/workflows/reusable_build_docker.yaml
+++ b/.github/workflows/reusable_build_docker.yaml
@@ -0,0 +1,79 @@
+# This is a reusable workflow used by master and release CI
+on:
+  workflow_call:
+    inputs:
+      arch:
+        description: x86_64 or aarch64
+        required: true
+        type: string
+      bucket_suffix:
+        description: bucket suffix for packages
+        required: false
+        default: ''
+        type: string
+      version:
+        description: The Falco version to use when building images
+        required: true
+        type: string
+      tag:
+        description: The tag to use (e.g. "master" or "0.35.0")
+        required: true
+        type: string
+
+# Here we just build all docker images as tarballs, 
+# then we upload all the tarballs to be later downloaded by reusable_publish_docker workflow.
+# In this way, we don't need to publish any arch specific image, 
+# and this "build" workflow is actually only building images.
+jobs:
+  build-docker:
+    # See https://github.com/actions/runner/issues/409#issuecomment-1158849936
+    runs-on: ${{ (inputs.arch == 'aarch64' && fromJSON('[ "self-hosted", "linux", "ARM64" ]')) || 'ubuntu-latest' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+          
+      - name: Build no-driver image
+        uses: docker/build-push-action@v3
+        with:
+          context: ${{ github.workspace }}/docker/no-driver/
+          build-args: |
+            VERSION_BUCKET=bin${{ inputs.bucket_suffix }}
+            FALCO_VERSION=${{ inputs.version }}
+          tags: |
+            docker.io/falcosecurity/falco-no-driver:${{ inputs.arch }}-${{ inputs.tag }}
+          outputs: type=docker,dest=/tmp/falco-no-driver-${{ inputs.arch }}.tar
+            
+      - name: Build falco image
+        uses: docker/build-push-action@v3
+        with:
+          context: ${{ github.workspace }}/docker/falco/
+          build-args: |
+            VERSION_BUCKET=deb${{ inputs.bucket_suffix }}
+            FALCO_VERSION=${{ inputs.version }}
+          tags: |
+            docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }}
+          outputs: type=docker,dest=/tmp/falco-${{ inputs.arch }}.tar
+
+      # The falcosecurity/falco image is required for the driver-loader image, so we need to load it
+      - name: Load the falcosecurity/falco image
+        run: |
+          docker load --input /tmp/falco-${{ inputs.arch }}.tar
+
+      - name: Build falco-driver-loader image
+        uses: docker/build-push-action@v3
+        with:
+          context: ${{ github.workspace }}/docker/driver-loader/
+          build-args: |
+            FALCO_IMAGE_TAG=${{ inputs.arch }}-${{ inputs.tag }}
+          tags: |
+            docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }}
+          outputs: type=docker,dest=/tmp/falco-driver-loader-${{ inputs.arch }}.tar  
+            
+      - name: Upload images tarballs
+        uses: actions/upload-artifact@v3
+        with:
+          name: falco-images
+          path: /tmp/falco-*.tar
--- a/.github/workflows/reusable_build_packages.yaml
+++ b/.github/workflows/reusable_build_packages.yaml
@@ -0,0 +1,160 @@
+# This is a reusable workflow used by master and release CI
+on:
+  workflow_call:
+    inputs:
+      arch:
+        description: x86_64 or aarch64
+        required: true
+        type: string
+      version:
+        description: The Falco version to use when building packages
+        required: true
+        type: string
+
+jobs:
+  build-modern-bpf-skeleton:
+    # See https://github.com/actions/runner/issues/409#issuecomment-1158849936
+    runs-on: ${{ (inputs.arch == 'aarch64' && fromJSON('[ "self-hosted", "linux", "ARM64" ]')) || 'ubuntu-latest' }}
+    container: fedora:latest
+    steps:
+      # Always install deps before invoking checkout action, to properly perform a full clone.
+      - name: Install build dependencies
+        run: |
+          dnf install -y bpftool ca-certificates cmake make automake gcc gcc-c++ kernel-devel clang git pkg-config autoconf automake libbpf-devel
+    
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Build modern BPF skeleton
+        run: |
+          mkdir skeleton-build && cd skeleton-build
+          cmake -DUSE_BUNDLED_DEPS=ON -DBUILD_FALCO_MODERN_BPF=ON -DCREATE_TEST_TARGETS=Off -DFALCO_VERSION=${{ inputs.version }} ..
+          make ProbeSkeleton -j6
+          
+      - name: Upload skeleton
+        uses: actions/upload-artifact@v3
+        with:
+          name: bpf_probe_${{ inputs.arch }}.skel.h
+          path: skeleton-build/skel_dir/bpf_probe.skel.h
+          
+  build-packages:
+    # See https://github.com/actions/runner/issues/409#issuecomment-1158849936
+    runs-on: ${{ (inputs.arch == 'aarch64' && fromJSON('[ "self-hosted", "linux", "ARM64" ]')) || 'ubuntu-latest' }}
+    needs: [build-modern-bpf-skeleton]
+    container: centos:7
+    steps:
+      # Always install deps before invoking checkout action, to properly perform a full clone.
+      - name: Install build dependencies
+        run: |
+          yum -y install centos-release-scl
+          yum -y install devtoolset-9-gcc devtoolset-9-gcc-c++
+          source /opt/rh/devtoolset-9/enable
+          yum install -y wget git make m4 rpm-build
+    
+      - name: Checkout
+        uses: actions/checkout@v3
+    
+      - name: Download skeleton
+        uses: actions/download-artifact@v3
+        with:
+          name: bpf_probe_${{ inputs.arch }}.skel.h
+          path: /tmp
+          
+      - name: Install updated cmake
+        run: |
+          curl -L -o /tmp/cmake.tar.gz https://github.com/Kitware/CMake/releases/download/v3.22.5/cmake-3.22.5-linux-$(uname -m).tar.gz
+          gzip -d /tmp/cmake.tar.gz
+          tar -xpf /tmp/cmake.tar --directory=/tmp
+          cp -R /tmp/cmake-3.22.5-linux-$(uname -m)/* /usr
+          rm -rf /tmp/cmake-3.22.5-linux-$(uname -m)
+    
+      - name: Prepare project
+        run: |
+          mkdir build && cd build
+          source /opt/rh/devtoolset-9/enable
+          cmake \
+              -DCMAKE_BUILD_TYPE=Release \
+              -DUSE_BUNDLED_DEPS=On \
+              -DFALCO_ETC_DIR=/etc/falco \
+              -DBUILD_FALCO_MODERN_BPF=ON \
+              -DMODERN_BPF_SKEL_DIR=/tmp \
+              -DBUILD_DRIVER=Off \
+              -DBUILD_BPF=Off \
+              -DFALCO_VERSION=${{ inputs.version }} \
+              ..
+              
+      - name: Build project
+        run: |
+          cd build
+          source /opt/rh/devtoolset-9/enable
+          make falco -j6
+      
+      - name: Build packages
+        run: |
+          cd build
+          source /opt/rh/devtoolset-9/enable
+          make package
+
+      - name: Upload Falco tar.gz package
+        uses: actions/upload-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-${{ inputs.arch }}.tar.gz
+          path: |
+            ${{ github.workspace }}/build/falco-*.tar.gz
+            
+      - name: Upload Falco deb package
+        uses: actions/upload-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-${{ inputs.arch }}.deb
+          path: |
+            ${{ github.workspace }}/build/falco-*.deb
+      
+      - name: Upload Falco rpm package
+        uses: actions/upload-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-${{ inputs.arch }}.rpm
+          path: |
+            ${{ github.workspace }}/build/falco-*.rpm
+            
+  build-musl-package:
+    # x86_64 only for now
+    if: ${{ inputs.arch == 'x86_64' }}
+    runs-on: ubuntu-latest
+    container: alpine:3.17
+    steps:
+      # Always install deps before invoking checkout action, to properly perform a full clone.
+      - name: Install build dependencies
+        run: |
+          apk add g++ gcc cmake make git bash perl linux-headers autoconf automake m4 libtool elfutils-dev libelf-static patch binutils bpftool clang
+    
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          
+      - name: Prepare project
+        run: |
+          mkdir build && cd build
+          cmake -DCPACK_GENERATOR=TGZ -DBUILD_BPF=Off -DBUILD_DRIVER=Off -DCMAKE_BUILD_TYPE=Release -DUSE_BUNDLED_DEPS=On -DUSE_BUNDLED_LIBELF=Off -DBUILD_LIBSCAP_MODERN_BPF=ON -DMUSL_OPTIMIZED_BUILD=On -DFALCO_ETC_DIR=/etc/falco ../ -DFALCO_VERSION=${{ inputs.version }}
+          
+      - name: Build project
+        run: |
+          cd build
+          make -j6 all
+      
+      - name: Build packages
+        run: |
+          cd build
+          make -j6 package
+
+      - name: Rename static package
+        run: |
+          cd build
+          mv falco-${{ inputs.version }}-x86_64.tar.gz falco-${{ inputs.version }}-static-x86_64.tar.gz 
+          
+      - name: Upload Falco static package
+        uses: actions/upload-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-static-x86_64.tar.gz
+          path: |
+            ${{ github.workspace }}/build/falco-${{ inputs.version }}-static-x86_64.tar.gz
--- a/.github/workflows/reusable_publish_docker.yaml
+++ b/.github/workflows/reusable_publish_docker.yaml
@@ -0,0 +1,144 @@
+# This is a reusable workflow used by master and release CI
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: The tag to push
+        required: true
+        type: string
+      is_latest:
+        description: Update the latest tag with the new image
+        required: false
+        type: boolean
+        default: false
+      sign:
+        description: Add signature with cosign
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  id-token: write
+  contents: read
+  
+jobs:
+  publish-docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+    
+      - name: Download images tarballs
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-images
+          path: /tmp/falco-images
+      
+      - name: Load all images
+        run: |
+          for img in /tmp/falco-images/falco-*.tar; do docker load --input $img; done
+    
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_SECRET }}
+      
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: "arn:aws:iam::292999226676:role/github_actions-falco-ecr"
+          aws-region: us-east-1 # The region must be set to us-east-1 in order to access ECR Public.
+          
+      - name: Login to Amazon ECR
+        id: login-ecr-public
+        uses: aws-actions/amazon-ecr-login@2f9f10ea3fa2eed41ac443fee8bfbd059af2d0a4 # v1.6.0
+        with:
+          registry-type: public    
+      
+      - name: Setup Crane
+        uses: imjasonh/setup-crane@v0.3
+        with:
+          version: v0.15.1
+
+      # We're pushing the arch-specific manifests to Docker Hub so that we'll be able to easily create the index/multiarch later
+      - name: Push arch-specific images to Docker Hub
+        run: |
+          docker push docker.io/falcosecurity/falco-no-driver:aarch64-${{ inputs.tag }}
+          docker push docker.io/falcosecurity/falco-no-driver:x86_64-${{ inputs.tag }}
+          docker push docker.io/falcosecurity/falco:aarch64-${{ inputs.tag }}
+          docker push docker.io/falcosecurity/falco:x86_64-${{ inputs.tag }}
+          docker push docker.io/falcosecurity/falco-driver-loader:aarch64-${{ inputs.tag }}
+          docker push docker.io/falcosecurity/falco-driver-loader:x86_64-${{ inputs.tag }}
+
+      - name: Create no-driver manifest on Docker Hub
+        uses: Noelware/docker-manifest-action@0.3.1
+        with:
+          inputs: docker.io/falcosecurity/falco-no-driver:${{ inputs.tag }}
+          images: docker.io/falcosecurity/falco-no-driver:aarch64-${{ inputs.tag }},docker.io/falcosecurity/falco-no-driver:x86_64-${{ inputs.tag }}
+          push: true
+          
+      - name: Tag slim manifest on Docker Hub
+        run: |
+          crane copy docker.io/falcosecurity/falco-no-driver:${{ inputs.tag }} docker.io/falcosecurity/falco:${{ inputs.tag }}-slim
+
+      - name: Create falco manifest on Docker Hub
+        uses: Noelware/docker-manifest-action@0.3.1
+        with:
+          inputs: docker.io/falcosecurity/falco:${{ inputs.tag }}
+          images: docker.io/falcosecurity/falco:aarch64-${{ inputs.tag }},docker.io/falcosecurity/falco:x86_64-${{ inputs.tag }}
+          push: true
+          
+      - name: Create falco-driver-loader manifest on Docker Hub
+        uses: Noelware/docker-manifest-action@0.3.1
+        with:
+          inputs: docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }}
+          images: docker.io/falcosecurity/falco-driver-loader:aarch64-${{ inputs.tag }},docker.io/falcosecurity/falco-driver-loader:x86_64-${{ inputs.tag }}
+          push: true
+
+      - name: Get Digests for images
+        id: digests
+        run: |
+          echo "falco-no-driver=$(crane digest docker.io/falcosecurity/falco-no-driver:${{ inputs.version }})" >> $GITHUB_OUTPUT
+          echo "falco=$(crane digest docker.io/falcosecurity/falco:${{ inputs.version }})" >> $GITHUB_OUTPUT
+          echo "falco-driver-loader=$(crane digest docker.io/falcosecurity/falco-driver-loader:${{ inputs.version }})" >> $GITHUB_OUTPUT
+
+      - name: Publish images to ECR
+        run: |
+          crane copy docker.io/falcosecurity/falco-no-driver:${{ inputs.tag }} public.ecr.aws/falcosecurity/falco-no-driver:${{ inputs.tag }}
+          crane copy docker.io/falcosecurity/falco:${{ inputs.tag }} public.ecr.aws/falcosecurity/falco:${{ inputs.tag }}
+          crane copy docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }} public.ecr.aws/falcosecurity/falco-driver-loader:${{ inputs.tag }}
+          crane copy public.ecr.aws/falcosecurity/falco-no-driver:${{ inputs.tag }} public.ecr.aws/falcosecurity/falco:${{ inputs.tag }}-slim
+
+      - name: Tag latest on Docker Hub and ECR
+        if: inputs.is_latest
+        run: |
+          crane tag docker.io/falcosecurity/falco-no-driver:${{ inputs.tag }} latest
+          crane tag docker.io/falcosecurity/falco:${{ inputs.tag }} latest
+          crane tag docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }} latest
+          crane tag docker.io/falcosecurity/falco:${{ inputs.tag }}-slim latest-slim
+
+          crane tag public.ecr.aws/falcosecurity/falco-no-driver:${{ inputs.tag }} latest
+          crane tag public.ecr.aws/falcosecurity/falco:${{ inputs.tag }} latest
+          crane tag public.ecr.aws/falcosecurity/falco-driver-loader:${{ inputs.tag }} latest
+          crane tag public.ecr.aws/falcosecurity/falco:${{ inputs.tag }}-slim latest-slim
+
+      - name: Setup Cosign
+        if: inputs.sign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: v2.0.2
+
+      - name: Sign images with cosign
+        if: inputs.sign
+        env:
+          COSIGN_EXPERIMENTAL: "true"
+          COSIGN_YES: "true"
+        run: |
+          cosign sign docker.io/falcosecurity/falco-no-driver@${{ steps.digests.outputs.falco-no-driver }}
+          cosign sign docker.io/falcosecurity/falco@${{ steps.digests.outputs.falco }}
+          cosign sign docker.io/falcosecurity/falco-driver-loader@${{ steps.digests.outputs.falco-driver-loader }}
+
+          cosign sign public.ecr.aws/falcosecurity/falco-no-driver@${{ steps.digests.outputs.falco-no-driver }}
+          cosign sign public.ecr.aws/falcosecurity/falco@${{ steps.digests.outputs.falco }}
+          cosign sign public.ecr.aws/falcosecurity/falco-driver-loader@${{ steps.digests.outputs.falco-driver-loader }}
--- a/.github/workflows/reusable_publish_packages.yaml
+++ b/.github/workflows/reusable_publish_packages.yaml
@@ -0,0 +1,150 @@
+# This is a reusable workflow used by master and release CI
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: The Falco version to use when publishing packages
+        required: true
+        type: string
+      bucket_suffix:
+        description: bucket suffix for packages
+        required: false
+        default: ''
+        type: string
+       
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  AWS_S3_REGION: eu-west-1
+  AWS_CLOUDFRONT_DIST_ID: E1CQNPFWRXLGQD
+
+jobs:
+  publish-packages:
+    runs-on: ubuntu-latest
+    container: docker.io/centos:7
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+    
+      - name: Install dependencies
+        run: |
+          yum install epel-release -y
+          yum update -y
+          yum install rpm-sign expect which createrepo gpg python python-pip -y
+          pip install awscli==1.19.47
+
+      # Configure AWS role; see https://github.com/falcosecurity/test-infra/pull/1102
+      # Note: master CI can only push dev packages as we have 2 different roles for master and release.
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: "arn:aws:iam::292999226676:role/github_actions-falco${{ inputs.bucket_suffix }}-s3"
+          aws-region: ${{ env.AWS_S3_REGION }}    
+          
+      - name: Download RPM x86_64
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-x86_64.rpm
+          path: /tmp/falco-rpm
+
+      - name: Download RPM aarch64
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-aarch64.rpm
+          path: /tmp/falco-rpm
+
+      - name: Download binary x86_64
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-x86_64.tar.gz
+          path: /tmp/falco-bin
+
+      - name: Download binary aarch64
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-aarch64.tar.gz
+          path: /tmp/falco-bin
+
+      - name: Download static binary x86_64
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-static-x86_64.tar.gz
+          path: /tmp/falco-bin-static
+        
+      - name: Import gpg key 
+        env:
+          GPG_KEY: ${{ secrets.GPG_KEY }}
+        run: printenv GPG_KEY | gpg --import -
+        
+      - name: Sign rpms
+        run: |
+          echo "%_signature gpg" > ~/.rpmmacros
+          echo "%_gpg_name  Falcosecurity Package Signing" >> ~/.rpmmacros
+          echo "%__gpg_sign_cmd %{__gpg} --force-v3-sigs --batch --no-armor --passphrase-fd 3 --no-secmem-warning -u \"%{_gpg_name}\" -sb --digest-algo sha256 %{__plaintext_filename}'" >> ~/.rpmmacros
+          cat > ~/sign <<EOF
+          #!/usr/bin/expect -f
+          spawn rpmsign --addsign {*}\$argv
+          expect -exact "Enter pass phrase: "
+          send -- "\n"
+          expect eof
+          EOF
+          chmod +x ~/sign
+          ~/sign /tmp/falco-rpm/falco-*.rpm
+          rpm --qf %{SIGPGP:pgpsig} -qp /tmp/falco-rpm/falco-*.rpm | grep SHA256
+          
+      - name: Publish rpm
+        run: |
+          ./scripts/publish-rpm -f /tmp/falco-rpm/falco-${{ inputs.version }}-x86_64.rpm -f /tmp/falco-rpm/falco-${{ inputs.version }}-aarch64.rpm -r rpm${{ inputs.bucket_suffix }}
+      
+      - name: Publish bin
+        run: |
+          ./scripts/publish-bin -f /tmp/falco-bin/falco-${{ inputs.version }}-x86_64.tar.gz -r bin${{ inputs.bucket_suffix }} -a x86_64
+          ./scripts/publish-bin -f /tmp/falco-bin/falco-${{ inputs.version }}-aarch64.tar.gz -r bin${{ inputs.bucket_suffix }} -a aarch64
+          
+      - name: Publish static
+        run: |
+          ./scripts/publish-bin -f /tmp/falco-bin-static/falco-${{ inputs.version }}-static-x86_64.tar.gz -r bin${{ inputs.bucket_suffix }} -a x86_64
+          
+  publish-packages-deb:
+    runs-on: ubuntu-latest
+    container: docker.io/debian:stable
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+    
+      - name: Install dependencies
+        run: |
+          apt update -y
+          apt-get install apt-utils bzip2 gpg python python3-pip -y
+          pip install awscli
+      
+      # Configure AWS role; see https://github.com/falcosecurity/test-infra/pull/1102
+      # Note: master CI can only push dev packages as we have 2 different roles for master and release.
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: "arn:aws:iam::292999226676:role/github_actions-falco${{ inputs.bucket_suffix }}-s3"
+          aws-region: ${{ env.AWS_S3_REGION }}     
+      
+      - name: Download deb x86_64
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-x86_64.deb
+          path: /tmp/falco-deb
+
+      - name: Download deb aarch64
+        uses: actions/download-artifact@v3
+        with:
+          name: falco-${{ inputs.version }}-aarch64.deb
+          path: /tmp/falco-deb
+
+      - name: Import gpg key 
+        env:
+          GPG_KEY: ${{ secrets.GPG_KEY }}
+        run: printenv GPG_KEY | gpg --import -
+          
+      - name: Publish deb
+        run: |
+          ./scripts/publish-deb -f /tmp/falco-deb/falco-${{ inputs.version }}-x86_64.deb -f /tmp/falco-deb/falco-${{ inputs.version }}-aarch64.deb -r deb${{ inputs.bucket_suffix }}
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -44,6 +44,8 @@ if (${EP_UPDATE_DISCONNECTED})
    PROPERTY EP_UPDATE_DISCONNECTED TRUE)
 endif()

+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_EXTENSIONS OFF)

 # Elapsed time
 # set_property(GLOBAL PROPERTY RULE_LAUNCH_COMPILE "${CMAKE_COMMAND} -E time") # TODO(fntlnz, leodido): add a flag to enable this
@@ -108,7 +110,7 @@ if(BUILD_WARNINGS_AS_ERRORS)
 endif()

 set(CMAKE_C_FLAGS "${CMAKE_COMMON_FLAGS}")
-set(CMAKE_CXX_FLAGS "--std=c++0x ${CMAKE_COMMON_FLAGS} -Wno-class-memaccess")
+set(CMAKE_CXX_FLAGS "-std=c++17 ${CMAKE_COMMON_FLAGS} -Wno-class-memaccess")

 set(CMAKE_C_FLAGS_DEBUG "${FALCO_EXTRA_DEBUG_FLAGS}")
 set(CMAKE_CXX_FLAGS_DEBUG "${FALCO_EXTRA_DEBUG_FLAGS}")
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -113,26 +113,29 @@ The release PR is meant to be made against the respective `release/M.m.x` branch
 - Close the completed milestone as soon as the PR is merged into the release branch
 - Cherry pick the PR on master too

+## Publishing Pre-Releases (RCs and tagged development versions)
+
+Core maintainers and/or the release manager can decide to publish pre-releases at any time before the final release
+is live for development and testing purposes.
+
+The prerelease tag must be formatted as `M.m.p-r`where `r` is the prerelease version information (e.g. `0.35.0-rc1`.)
+
+To do so:
+
+- [Draft a new release](https://github.com/falcosecurity/falco/releases/new)
+- Use `M.m.p-r` both as tag version and release title.
+- Check the "Set as a pre-release" checkbox and make sure "Set as the latest release" is unchecked
+- It is recommended to add a brief description so that other contributors will understand the reason why the prerelease is published
+- Publish the prerelease!
+- The release pipeline will start automatically. Packages will be uploaded to the `-dev` bucket and container images will be tagged with the specified tag.
+
+In order to check the status of the release pipeline click on the [GitHub Actions tab](https://github.com/falcosecurity/falco/actions?query=event%3Arelease) in the Falco repository and filter by release.
+
 ## Release

 Assume `M.m.p` is the new version.

-### 1. Create a tag
-
- Once the release PR has got merged both on the release branch and on master, and the master CI has done its job, git tag the new release on the release branch:
-
-    ```
-    git pull
-    git checkout release/M.m.x
-    git tag M.m.p
-    git push origin M.m.p
-    ```
-
-> **N.B.**: do NOT use an annotated tag. For reference https://git-scm.com/book/en/v2/Git-Basics-Tagging
-
- Wait for the CI to complete
-
-### 2. Update the GitHub release
+### 1. Create the release with GitHub

 - [Draft a new release](https://github.com/falcosecurity/falco/releases/new)
 - Use `M.m.p` both as tag version and release title
@@ -176,8 +179,11 @@ Assume `M.m.p` is the new version.
    ```

 - Finally, publish the release!
+- The release pipeline will start automatically upon publication and all packages and container images will be uploaded to the stable repositories.

-### 3. Update the meeting notes
+In order to check the status of the release pipeline click on the [GitHub Actions tab](https://github.com/falcosecurity/falco/actions?query=event%3Arelease) in the Falco repository and filter by release.
+
+### 2. Update the meeting notes

 For each release we archive the meeting notes in git for historical purposes.

--- a/brand/README.md
+++ b/brand/README.md
@@ -3,7 +3,9 @@

 # Falco Branding Guidelines

-This document describes The Falco Project's branding guidelines, language, and message.
+Falco is an open source security project whose brand and identity are governed by the [Cloud Native Computing Foundation](https://www.linuxfoundation.org/legal/trademark-usage).
+
+This document describes the official branding guidelines of The Falco Project. Please see the [Falco Branding](https://falco.org/community/falco-brand/) page on our website for further details.

 Content in this document can be used to publicly share about Falco.

@@ -82,7 +84,7 @@ Examples of malicious behavior include:

 Falco is capable of [consuming the Kubernetes audit logs](https://kubernetes.io/docs/tasks/debug-application-cluster/falco/#use-falco-to-collect-audit-events).
 By adding Kubernetes application context, and Kubernetes audit logs teams can understand who did what.
-                                 
+
 ### Writing about Falco

 ##### Yes
@@ -122,7 +124,6 @@ Falco does not prevent unwanted behavior.
 Falco however alerts when unusual behavior occurs.
 This is commonly referred to as **detection** or **forensics**.

-
 ---

 # Glossary 
--- a/cmake/modules/GetGitRevisionDescription.cmake
+++ b/cmake/modules/GetGitRevisionDescription.cmake
@@ -91,15 +91,16 @@ function(git_get_latest_tag _var)
    find_package(Git QUIET)
  endif()

-  # We use git describe --tags `git rev-list --tags --max-count=1`
+  # We use git describe --tags `git rev-list --exclude "*.*.*-*" --tags --max-count=1`
+  # Note how we eclude prereleases tags (the ones with "-alphaX")
  execute_process(COMMAND
          "${GIT_EXECUTABLE}"
          rev-list
+          --exclude "*.*.*-*"
          --tags
          --max-count=1
          WORKING_DIRECTORY
          "${CMAKE_CURRENT_SOURCE_DIR}"
-          COMMAND tail -n1
          RESULT_VARIABLE
          res
          OUTPUT_VARIABLE
--- a/cmake/modules/driver.cmake
+++ b/cmake/modules/driver.cmake
@@ -26,8 +26,8 @@ else()
  # In case you want to test against another driver version (or branch, or commit) just pass the variable -
  # ie., `cmake -DDRIVER_VERSION=dev ..`
  if(NOT DRIVER_VERSION)
-    set(DRIVER_VERSION "2024af2e264e1cd76ec8bc43924f1857937848a8")
-    set(DRIVER_CHECKSUM "SHA256=af98c4c505882a899eab38a7f7b7cc92cba634d81a110a18c42243214f9ffc5f")
+    set(DRIVER_VERSION "5.0.0+driver")
+    set(DRIVER_CHECKSUM "SHA256=c988ca7ac7d174f62d1bfbaaca49efd117f7b329f474d1b46b643635b2e35083")
  endif()

  # cd /path/to/build && cmake /path/to/source
--- a/cmake/modules/falcosecurity-libs.cmake
+++ b/cmake/modules/falcosecurity-libs.cmake
@@ -27,12 +27,15 @@ else()
  # In case you want to test against another falcosecurity/libs version (or branch, or commit) just pass the variable -
  # ie., `cmake -DFALCOSECURITY_LIBS_VERSION=dev ..`
  if(NOT FALCOSECURITY_LIBS_VERSION)
-    set(FALCOSECURITY_LIBS_VERSION "2024af2e264e1cd76ec8bc43924f1857937848a8")
-    set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=af98c4c505882a899eab38a7f7b7cc92cba634d81a110a18c42243214f9ffc5f")
+    set(FALCOSECURITY_LIBS_VERSION "2e9e6346eefeddd0afce7b6a06cb42d4265615dd")
+    set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=d5f37545ddc456f1e1489800b856f9770d8a092f2bd5841893669a0b7eb5ed55")
  endif()

  # cd /path/to/build && cmake /path/to/source
-  execute_process(COMMAND "${CMAKE_COMMAND}" -DFALCOSECURITY_LIBS_VERSION=${FALCOSECURITY_LIBS_VERSION} -DFALCOSECURITY_LIBS_CHECKSUM=${FALCOSECURITY_LIBS_CHECKSUM}
+  execute_process(COMMAND "${CMAKE_COMMAND}"
+      -DCMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE}"
+      -DFALCOSECURITY_LIBS_VERSION=${FALCOSECURITY_LIBS_VERSION}
+      -DFALCOSECURITY_LIBS_CHECKSUM=${FALCOSECURITY_LIBS_CHECKSUM}
    ${FALCOSECURITY_LIBS_CMAKE_SOURCE_DIR} WORKING_DIRECTORY ${FALCOSECURITY_LIBS_CMAKE_WORKING_DIR})

  # cmake --build .
--- a/cmake/modules/plugins.cmake
+++ b/cmake/modules/plugins.cmake
@@ -13,22 +13,26 @@

 include(ExternalProject)

+# 'stable' or 'dev'
+set(PLUGINS_DOWNLOAD_BUCKET "dev")
+
 string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} PLUGINS_SYSTEM_NAME)

 if(NOT DEFINED PLUGINS_COMPONENT_NAME)
    set(PLUGINS_COMPONENT_NAME "${CMAKE_PROJECT_NAME}-plugins")
 endif()

-set(PLUGIN_K8S_AUDIT_VERSION "0.5.0")
+# k8saudit
+set(PLUGIN_K8S_AUDIT_VERSION "0.5.3-0.5.3-27%2B7b07a4b")
 if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
-    set(PLUGIN_K8S_AUDIT_HASH "c4abb288df018940be8e548340a74d39623b69142304e01523ea189bc698bc80")
+    set(PLUGIN_K8S_AUDIT_HASH "22c15e5aa2c86cf2216cd767f8766047696e9ba637d63c5ae5e00893f0efad9c")
 else() # aarch64
-    set(PLUGIN_K8S_AUDIT_HASH "3bcc849d9f95a3fa519b4592d0947149e492b530fb935a3f98f098e234b7baa7")
+    set(PLUGIN_K8S_AUDIT_HASH "564f95031b973296fd7ccdda6c4a4f6820bb6da8106bcd48a549a7fca8c02540")
 endif()

 ExternalProject_Add(
  k8saudit-plugin
-  URL "https://download.falco.org/plugins/stable/k8saudit-${PLUGIN_K8S_AUDIT_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/k8saudit-${PLUGIN_K8S_AUDIT_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
  URL_HASH "SHA256=${PLUGIN_K8S_AUDIT_HASH}"
  CONFIGURE_COMMAND ""
  BUILD_COMMAND ""
@@ -38,24 +42,25 @@ install(FILES "${PROJECT_BINARY_DIR}/k8saudit-plugin-prefix/src/k8saudit-plugin/

 ExternalProject_Add(
  k8saudit-rules
-  URL "https://download.falco.org/plugins/stable/k8saudit-rules-${PLUGIN_K8S_AUDIT_VERSION}.tar.gz"
-  URL_HASH "SHA256=4383c69ba0ad63a127667c05618c37effc5297e6a7e68a1492acb0e48386540e"
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/k8saudit-rules-${PLUGIN_K8S_AUDIT_VERSION}.tar.gz"
+  URL_HASH "SHA256=d1add6c4dfe7e8aca85f536fd7577dd0d93662927ab604e6db6757e89b99f2b2"
  CONFIGURE_COMMAND ""
  BUILD_COMMAND ""
  INSTALL_COMMAND "")

 install(FILES "${PROJECT_BINARY_DIR}/k8saudit-rules-prefix/src/k8saudit-rules/k8s_audit_rules.yaml" DESTINATION "${FALCO_ETC_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")

-set(PLUGIN_CLOUDTRAIL_VERSION "0.7.0")
+# cloudtrail
+set(PLUGIN_CLOUDTRAIL_VERSION "0.7.3-0.7.3-27%2B7b07a4b")
 if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
-    set(PLUGIN_CLOUDTRAIL_HASH "85d94d8f5915804d5a30ff2f056e51de27d537f1fd1115050b4f4be6d32588cf")
+    set(PLUGIN_CLOUDTRAIL_HASH "856f5f5505c72776a188ba29633d81e5f21924b20c2cfb5a2da3f8f21410e248")
 else() # aarch64
-    set(PLUGIN_CLOUDTRAIL_HASH "61ae471ee41e76680da9ab66f583d1ec43a2e48fbad8c157caecef56e4aa5fb7")
+    set(PLUGIN_CLOUDTRAIL_HASH "935a96d68f182cec0f650186355bb245e36fdd884a596442992b55f066993fc1")
 endif()

 ExternalProject_Add(
  cloudtrail-plugin
-  URL "https://download.falco.org/plugins/stable/cloudtrail-${PLUGIN_CLOUDTRAIL_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/cloudtrail-${PLUGIN_CLOUDTRAIL_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
  URL_HASH "SHA256=${PLUGIN_CLOUDTRAIL_HASH}"
  CONFIGURE_COMMAND ""
  BUILD_COMMAND ""
@@ -65,24 +70,25 @@ install(FILES "${PROJECT_BINARY_DIR}/cloudtrail-plugin-prefix/src/cloudtrail-plu

 ExternalProject_Add(
  cloudtrail-rules
-  URL "https://download.falco.org/plugins/stable/cloudtrail-rules-${PLUGIN_CLOUDTRAIL_VERSION}.tar.gz"
-  URL_HASH "SHA256=c805be29ddc14fbffa29f7d6ee4f7e968a3bdb42da5f5483e5e6de273e8850c8"
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/cloudtrail-rules-${PLUGIN_CLOUDTRAIL_VERSION}.tar.gz"
+  URL_HASH "SHA256=4b92cb5f81be0734a87babbd48eb1dc15e1297168024072c3fd02ccee7550b73"
  CONFIGURE_COMMAND ""
  BUILD_COMMAND ""
  INSTALL_COMMAND "")

-  install(FILES "${PROJECT_BINARY_DIR}/cloudtrail-rules-prefix/src/cloudtrail-rules/aws_cloudtrail_rules.yaml" DESTINATION "${FALCO_ETC_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")
+install(FILES "${PROJECT_BINARY_DIR}/cloudtrail-rules-prefix/src/cloudtrail-rules/aws_cloudtrail_rules.yaml" DESTINATION "${FALCO_ETC_DIR}" COMPONENT "${PLUGINS_COMPONENT_NAME}")

-set(PLUGIN_JSON_VERSION "0.6.0")
+# json
+set(PLUGIN_JSON_VERSION "0.6.2-0.6.2-30%2B7b07a4b")
 if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
-    set(PLUGIN_JSON_HASH "15fb7eddd978e8bb03f05412e9446e264e4548d7423b3d724b99d6d87a8c1b27")
+    set(PLUGIN_JSON_HASH "9d3ef271667d9662fd47672b59ccace800ae1cc4f6d4c6d34edc1d9e26a87179")
 else() # aarch64
-    set(PLUGIN_JSON_HASH "4db23f35a750e10a5b7b54c9aa469a7587705e7faa22927e941b41f3c5533e9f")
+    set(PLUGIN_JSON_HASH "113a632f4dd05ef7c4537fafdc0114fbe736a1da10b8225d8aa1679442157d5b")
 endif()

 ExternalProject_Add(
  json-plugin
-  URL "https://download.falco.org/plugins/stable/json-${PLUGIN_JSON_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
+  URL "https://download.falco.org/plugins/${PLUGINS_DOWNLOAD_BUCKET}/json-${PLUGIN_JSON_VERSION}-${PLUGINS_SYSTEM_NAME}-${CMAKE_HOST_SYSTEM_PROCESSOR}.tar.gz"
  URL_HASH "SHA256=${PLUGIN_JSON_HASH}"
  CONFIGURE_COMMAND ""
  BUILD_COMMAND ""
--- a/docker/driver-loader/Dockerfile
+++ b/docker/driver-loader/Dockerfile
@@ -1,5 +1,5 @@
 ARG FALCO_IMAGE_TAG=latest
-FROM falcosecurity/falco:${FALCO_IMAGE_TAG}
+FROM docker.io/falcosecurity/falco:${FALCO_IMAGE_TAG}

 LABEL maintainer="cncf-falco-dev@lists.cncf.io"

--- a/falco.yaml
+++ b/falco.yaml
@@ -232,9 +232,8 @@ syscall_drop_failed_exit: false

 syscall_buf_size_preset: 4

-############## [EXPERIMENTAL] Modern BPF probe specific ##############
-# Please note: these configs regard only the modern BPF probe. They
-# are experimental so they could change over releases.
+############## Modern BPF probe specific ##############
+# Please note: these configs regard only the modern BPF probe.
 #
 # `cpus_for_each_syscall_buffer`
 #
@@ -297,7 +296,7 @@ syscall_buf_size_preset: 4

 modern_bpf:
  cpus_for_each_syscall_buffer: 2
-############## [EXPERIMENTAL] Modern BPF probe specific ##############
+############## Modern BPF probe specific ##############

 # Falco continuously monitors outputs performance. When an output channel does not allow
 # to deliver an alert within a given deadline, an error is reported indicating
@@ -362,11 +361,11 @@ stdout_output:
 #   (the endpoint name is configurable).
 # - /versions: responds with a JSON object containing version numbers of the
 #   internal Falco components (similar output as `falco --version -o json_output=true`).
-# 
+#
 # # NOTE: the /versions endpoint is useful to other services (such as falcoctl)
 # to retrieve info about a running Falco instance. Make sure the webserver is
 # enabled if you're using falcoctl either locally or with Kubernetes.
-# 
+#
 # The following options control the behavior of that webserver (enabled by default).
 #
 # The ssl_certificate is a combination SSL Certificate and corresponding
@@ -410,7 +409,7 @@ http_output:
  user_agent: "falcosecurity/falco"
  # Tell Falco to not verify the remote server.
  insecure: false
-  # Path to the CA certificate that can verify the remote server. 
+  # Path to the CA certificate that can verify the remote server.
  ca_cert: ""
  # Path to a specific file that will be used as the CA certificate store.
  ca_bundle: ""
@@ -460,87 +459,109 @@ metadata_download:
  watch_freq_sec: 1


-# base_syscalls ! Use with caution, read carefully !
+# base_syscalls ! [EXPERIMENTAL] Use with caution, read carefully !
 #
 # --- [Description]
 #
-# With this option you are in full control of the set of syscalls that
-# Falco will enable in the kernel for active tracing.
-
-# All syscalls and events from each enabled Falco rule are activated
-# even when choosing this option. This option allows you to define a
-# set of base syscalls that will be activated in addition to the
-# syscalls defined in the rules.
+# This option configures the set of syscalls that Falco traces.
 #
-# You may ask yourself why do we need to activate syscalls in addition to the rules?
+# --- [Falco's State Engine]
 #
-# Falco requires a set of syscalls to build up state in userspace. This is because for
-# example when spawning a new process or creating a network connection more than one syscall
-# is involved. Furthermore, properties of a process during its life time can be modified
-# by syscalls. Falco takes care of this by activating more syscalls than the ones defined
-# in the rules and by managing a smart process cache table in userspace.
-# Processes are purged when a process exits.
+# Falco requires a set of syscalls to build up state in userspace.
+# For example, when spawning a new process or network connection, multiple syscalls are involved.
+# Furthermore, properties of a process during its lifetime can be modified by
+# syscalls. Falco accounts for this by enabling the collection of additional syscalls than the
+# ones defined in the rules and by managing a smart process cache table in
+# userspace. Processes are purged from this table when a process exits.
 #
-# Looking back to what this option does, it activates all syscalls from the rules
-# (including resolved macros) and the ones specified here.
+# By default, with
+#   ```
+#   base_syscalls.custom_set = []
+#   base_syscalls.repair = false
+#   ```
+# Falco enables tracing for a syscall set gathered:
+#   (1) from (enabled) Falco rules
+#   (2) from a static, more verbose set defined in `libsinsp::events::sinsp_state_sc_set` in libs/userspace/libsinsp/events/sinsp_events_ppm_sc.cpp
+# This allows Falco to successfully build up it's state engine and life-cycle management.
 #
-# This puts the end user in the driver seat to tell Falco what it needs, but if not used correctly
-# Falco logs may be incomplete or wrong or Falco won't work at all. This option however can be
-# very useful to lower CPU utilization and allowing you to tailor Falco to specific environments
-# according to your organization's threat model and cost budget.
+# If the default behavior described above does not fit the user's use case for Falco,
+# the `base_syscalls` option allows for finer end-user control of syscalls traced by Falco.
 #
-# !!! When NOT using this option, Falco defaults to adding a static (more verbose) set of syscalls
-# in addition to the rules system calls Falco needs for its state engine build-up and life-cycle management.
+# --- [ base_syscalls.custom_set ]
 #
-# `base_syscalls.repair` is an experimental alternative to Falco's default state engine enforcement.
-# `base_syscalls.repair` is designed to be the most resourceful option to ensure Falco runs correctly
-# while activating a most minimal set of additional syscalls. The recommendations listed in the suggestions
-# section is effectively what `base_syscalls.repair` is doing in an automated manner. `base_syscalls.repair`
-# can be used with an empty custom set.
+# CAUTION: Misconfiguration of this setting may result in incomplete Falco event
+# logs or Falco being unable to trace events entirely.
+#
+# `base_syscalls.custom_set` allows the user to explicitly define an additional
+# set of syscalls to be traced in addition to the syscalls from each enabled Falco rule.
+#
+# This is useful in lowering CPU utilization and further tailoring Falco to
+# specific environments according to your threat model and budget constraints.
+#
+# --- [ base_syscalls.repair ]
+#
+# `base_syscalls.repair` is an alternative to Falco's default state engine enforcement.
+# When enabled, this option is designed to
+#   (1) ensure that Falco's state engine is correctly and successfully built-up
+#   (2) be the most system resource-friendly by activating the least number of
+#       additional syscalls (outside of those enabled for enabled rules)
+#
+# Setting `base_syscalls.repair` to `true` allows Falco to automatically configure
+# what is described in the [Suggestions] section below.
+#
+# `base_syscalls.repair` can be enabled with an empty custom set, meaning with the following,
+#   ```
+#   base_syscalls.custom_set = []
+#   base_syscalls.repair = true
+#   ```
+# Falco enables tracing for a syscall set gathered:
+#   (1) from (enabled) Falco rules
+#   (2) from minimal set of additional syscalls needed to "repair" the
+#       state engine and properly log event conditions specified in enabled Falco rules
 #
 # --- [Usage]
 #
-# List of system calls names (<syscall-name>) plus negative ("!<syscall-name>") notation supported.
+# List of system calls names (<syscall-name>), negative ("!<syscall-name>") notation supported.
 #
-# base_syscalls.repair: <bool>
+# Example:
 # base_syscalls.custom_set: [<syscall-name>, <syscall-name>, "!<syscall-name>"]
-#
-#
-# --- [Suggestions]
-#
-# Here are a few recommendations that may help you.
-# Setting `base_syscalls.repair: true` automates these recommendations for you.
-#
-# Consider to at minimum add the following syscalls regardless of the syscalls used in the rules.
-#
-# [clone, clone3, fork, vfork, execve, execveat, close]
-#
-# This is because some Falco fields for an execve* system call are retrieved
-# from the associated `clone`, `clone3`, `fork`, `vfork` syscall when spawning a
-# new process. The `close` system call is used to purge file descriptors from Falco's
-# internal thread / process cache table and should always be added when you have
-# rules around file descriptors.
-# (e.g. open, openat, openat2, socket, connect, accept, accept4 ... and many more)
-#
-# When network syscalls are used in rules we recommend to at minimum set
-#
-# [clone, clone3, fork, vfork, execve, execveat, close, socket, bind, getsockopt]
-#
-# It turns out that while you can log `connect` or `accept*` syscalls without the
-# socket system call, the log however would not contain the ip tuples.
-# For `listen` and `accept*` system calls you also need the `bind` system call.
-#
-# Lastly, if you care about the correct `uid`, `gid` or `sid`, `pgid` of a process when the
-# running process opens a file or makes a network connection, consider adding the following syscalls:
-#
-# setresuid, setsid, setuid, setgid, setpgid, setresgid, setsid, capset, chdir, chroot, fchdir
+# base_syscalls.repair: <bool>
 #
 # We recommend to only exclude syscalls, e.g. "!mprotect" if you need a fast deployment update
 # (overriding rules), else remove unwanted syscalls from the Falco rules.
 #
-# Passing `-o "log_level=debug"` to Falco's cmd args during a dry-run will print the
-# final set of syscalls to STDOUT.
-
+# Passing `-o "log_level=debug" -o "log_stderr=true" --dry-run` to Falco's
+# cmd args will print the final set of syscalls to STDOUT.
+#
+# --- [Suggestions]
+#
+# NOTE: setting `base_syscalls.repair: true` automates the following suggestions for you.
+#
+# These suggestions are subject to change as Falco and its state engine evolve.
+#
+# For execve* events:
+# Some Falco fields for an execve* syscall are retrieved from the associated
+# `clone`, `clone3`, `fork`, `vfork` syscalls when spawning a new process.
+# The `close` syscall is used to purge file descriptors from Falco's internal
+# thread / process cache table and is necessary for rules relating to file
+# descriptors (e.g. open, openat, openat2, socket, connect, accept, accept4 ... and many more)
+#
+# Consider enabling the following syscalls in `base_syscalls.custom_set` for process rules:
+# [clone, clone3, fork, vfork, execve, execveat, close]
+#
+# For networking related events:
+# While you can log `connect` or `accept*` syscalls without the socket syscall,
+# the log will not contain the ip tuples.
+# Additionally, for `listen` and `accept*` syscalls, the `bind` syscall is also necessary.
+#
+# We recommend the following as the minimum set for networking-related rules:
+# [clone, clone3, fork, vfork, execve, execveat, close, socket, bind, getsockopt]
+#
+# Lastly, for tracking the correct `uid`, `gid` or `sid`, `pgid` of a process when the
+# running process opens a file or makes a network connection, consider adding the
+# following to the above recommended syscall sets:
+# ... setresuid, setsid, setuid, setgid, setpgid, setresgid, setsid, capset, chdir, chroot, fchdir ...
+#
 base_syscalls:
-  repair: false
  custom_set: []
+  repair: false
--- a/scripts/falco-driver-loader
+++ b/scripts/falco-driver-loader
@@ -128,10 +128,38 @@ get_target_id() {

 	case "${OS_ID}" in
 	("amzn")
-		if [[ $VERSION_ID == "2" ]]; then
+		case "${VERSION_ID}" in
+		("2")
 			TARGET_ID="amazonlinux2"
-		else
+			;;
+		("2022")
+			TARGET_ID="amazonlinux2022"
+			;;
+		("2023")
+			TARGET_ID="amazonlinux2023"
+			;;
+		(*)
 			TARGET_ID="amazonlinux"
+			;;
+		esac
+		;;
+	("debian")
+		# Workaround: debian kernelreleases might now be actual kernel running;
+		# instead, they might be the Debian kernel package
+		# providing the compatible kernel ABI
+		# See https://lists.debian.org/debian-user/2017/03/msg00485.html
+		# Real kernel release is embedded inside the kernel version.
+		# Moreover, kernel arch, when present, is attached to the former,
+		# therefore make sure to properly take it and attach it to the latter.
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
+		local ARCH_extra=""
+		if [[ $KERNEL_RELEASE =~ -(amd64|arm64) ]];
+		then
+			ARCH_extra="-${BASH_REMATCH[1]}"
+		fi
+		if [[ $(uname -v) =~ ([0-9]+\.[0-9]+\.[0-9]+\-[0-9]+) ]];
+		then
+			KERNEL_RELEASE="${BASH_REMATCH[1]}${ARCH_extra}"
 		fi
 		;;
 	("ubuntu")
@@ -151,7 +179,7 @@ get_target_id() {
 		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
 		;;
 	("minikube")
-		TARGET_ID="${OS_ID}"
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
 		# Extract the minikube version. Ex. With minikube version equal to "v1.26.0-1655407986-14197" the extracted version
 		# will be "1.26.0"
 		if [[ $(cat ${HOST_ROOT}/etc/VERSION) =~ ([0-9]+(\.[0-9]+){2}) ]]; then
@@ -163,7 +191,7 @@ get_target_id() {
 		fi
 		;;
 	("bottlerocket")
-		TARGET_ID="${OS_ID}"
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
 		# variant_id has been sourced from os-release. Get only the first variant part
 		if [[ -n ${VARIANT_ID} ]];  then
 			# take just first part (eg: VARIANT_ID=aws-k8s-1.15 -> aws)
@@ -172,6 +200,11 @@ get_target_id() {
 		# version_id has been sourced from os-release. Build a kernel version like: 1_1.11.0-aws
 		KERNEL_VERSION="1_${VERSION_ID}-${VARIANT_ID_CUT}"
 		;;
+	("talos")
+		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
+		# version_id has been sourced from os-release. Build a kernel version like: 1_1.4.1
+		KERNEL_VERSION="1_${VERSION_ID}"
+		;;
 	(*)
 		TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
 		;;
@@ -232,10 +265,10 @@ load_kernel_module_compile() {
 			continue
 		fi
 		echo "* Trying to dkms install ${DRIVER_NAME} module with GCC ${CURRENT_GCC}"
-		echo "#!/usr/bin/env bash" > /tmp/falco-dkms-make
-		echo "make CC=${CURRENT_GCC} \$@" >> /tmp/falco-dkms-make
-		chmod +x /tmp/falco-dkms-make
-		if dkms install --directive="MAKE='/tmp/falco-dkms-make'" -m "${DRIVER_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then
+		echo "#!/usr/bin/env bash" > "${TMPDIR}/falco-dkms-make"
+		echo "make CC=${CURRENT_GCC} \$@" >> "${TMPDIR}/falco-dkms-make"
+		chmod +x "${TMPDIR}/falco-dkms-make"
+		if dkms install --directive="MAKE='${TMPDIR}/falco-dkms-make'" -m "${DRIVER_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then
 			echo "* ${DRIVER_NAME} module installed in dkms"
 			KO_FILE="/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}"
 			if [ -f "$KO_FILE.ko" ]; then
@@ -659,6 +692,8 @@ if [ -v FALCO_BPF_PROBE ]; then
 	DRIVER="bpf"
 fi

+TMPDIR=${TMPDIR:-"/tmp"}
+
 ENABLE_COMPILE=
 ENABLE_DOWNLOAD=

--- a/submodules/falcosecurity-rules
+++ b/submodules/falcosecurity-rules
--- a/test/falco_tests_plugins.yaml
+++ b/test/falco_tests_plugins.yaml
@@ -56,7 +56,7 @@ trace_files: !mux

  incompatible_extract_sources:
    exit_status: 1
-    stderr_contains: "Plugin '.*' has field extraction capability but is not compatible with any known event source"
+    stderr_contains: "Plugin '.*' is loaded but unused as not compatible with any known event source"
    conf_file: BUILD_DIR/test/confs/plugins/incompatible_extract_sources.yaml
    rules_file:
      - rules/plugins/cloudtrail_create_instances.yaml
--- a/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp
+++ b/unit_tests/falco/app/actions/test_configure_interesting_sets.cpp
@@ -17,6 +17,7 @@ limitations under the License.

 #include <falco_engine.h>

+#include <falco/app/app.h>
 #include <falco/app/state.h>
 #include <falco/app/actions/actions.h>

@@ -91,6 +92,7 @@ static std::shared_ptr<falco_engine> mock_engine_from_filters(const strset_t& fi

 TEST(ConfigureInterestingSets, engine_codes_syscalls_set)
 {
+
 	auto engine = mock_engine_from_filters(s_sample_filters);
 	auto enabled_count = engine->num_rules_for_ruleset(s_sample_ruleset);
 	ASSERT_EQ(enabled_count, s_sample_filters.size());
@@ -99,45 +101,45 @@ TEST(ConfigureInterestingSets, engine_codes_syscalls_set)
 	auto rules_event_set = engine->event_codes_for_ruleset(s_sample_source);
 	auto rules_event_names = libsinsp::events::event_set_to_names(rules_event_set);
 	ASSERT_NAMES_EQ(rules_event_names, strset_t({
-		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "container"}));
+		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "container", "asyncevent"}));

 	// test if sc code names were extracted from each rule in test ruleset.
 	// note, this is not supposed to contain "container", as that's an event
 	// not mapped through the ppm_sc_code enumerative.
 	auto rules_sc_set = engine->sc_codes_for_ruleset(s_sample_source);
-	auto rules_sc_names = libsinsp::events::sc_set_to_names(rules_sc_set);
+	auto rules_sc_names = libsinsp::events::sc_set_to_event_names(rules_sc_set);
 	ASSERT_NAMES_EQ(rules_sc_names, strset_t({
 		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read"}));
 }

 TEST(ConfigureInterestingSets, preconditions_postconditions)
 {
-	falco::app::state s;
 	auto mock_engine = mock_engine_from_filters(s_sample_filters);
+	falco::app::state s1;

-	s.engine = mock_engine;
-	s.config = nullptr;
-	auto result = falco::app::actions::configure_interesting_sets(s);
+	s1.engine = mock_engine;
+	s1.config = nullptr;
+	auto result = falco::app::actions::configure_interesting_sets(s1);
 	ASSERT_FALSE(result.success);
 	ASSERT_NE(result.errstr, "");

-	s.engine = nullptr;
-	s.config = std::make_shared<falco_configuration>();
-	result = falco::app::actions::configure_interesting_sets(s);
+	s1.engine = nullptr;
+	s1.config = std::make_shared<falco_configuration>();
+	result = falco::app::actions::configure_interesting_sets(s1);
 	ASSERT_FALSE(result.success);
 	ASSERT_NE(result.errstr, "");

-	s.engine = mock_engine;
-	s.config = std::make_shared<falco_configuration>();
-	result = falco::app::actions::configure_interesting_sets(s);
+	s1.engine = mock_engine;
+	s1.config = std::make_shared<falco_configuration>();
+	result = falco::app::actions::configure_interesting_sets(s1);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");

-	auto prev_selection_size = s.selected_sc_set.size();
-	result = falco::app::actions::configure_interesting_sets(s);
+	auto prev_selection_size = s1.selected_sc_set.size();
+	result = falco::app::actions::configure_interesting_sets(s1);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");
-	ASSERT_EQ(prev_selection_size, s.selected_sc_set.size());
+	ASSERT_EQ(prev_selection_size, s1.selected_sc_set.size());
 }

 TEST(ConfigureInterestingSets, engine_codes_nonsyscalls_set)
@@ -159,25 +161,27 @@ TEST(ConfigureInterestingSets, engine_codes_nonsyscalls_set)
 	auto generic_names = libsinsp::events::event_set_to_names({ppm_event_code::PPME_GENERIC_E});
 	auto expected_names = strset_t({
 		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "container", // ruleset
-		"procexit", "switch", "pluginevent"}); // from non-syscall event filters
+		"procexit", "switch", "pluginevent", "asyncevent"}); // from non-syscall event filters
 	expected_names.insert(generic_names.begin(), generic_names.end());
 	ASSERT_NAMES_EQ(rules_event_names, expected_names);

 	auto rules_sc_set = engine->sc_codes_for_ruleset(s_sample_source);
-	auto rules_sc_names = libsinsp::events::sc_set_to_names(rules_sc_set);
+	auto rules_sc_names = libsinsp::events::sc_set_to_event_names(rules_sc_set);
 	ASSERT_NAMES_EQ(rules_sc_names, strset_t({
 		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read",
-		"syncfs", "fanotify_init", // from generic event filters
+		"procexit", "switch", "syncfs", "fanotify_init", // from generic event filters
 	}));
 }

 TEST(ConfigureInterestingSets, selection_not_allevents)
 {
+	falco::app::state s2;
 	// run app action with fake engine and without the `-A` option
-	falco::app::state s;
-	s.engine = mock_engine_from_filters(s_sample_filters);
-	s.options.all_events = false;
-	auto result = falco::app::actions::configure_interesting_sets(s);
+	s2.engine = mock_engine_from_filters(s_sample_filters);
+	s2.options.all_events = false;
+
+	ASSERT_EQ(s2.options.all_events, false);
+	auto result = falco::app::actions::configure_interesting_sets(s2);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");

@@ -185,8 +189,8 @@ TEST(ConfigureInterestingSets, selection_not_allevents)
 	// also check if a warning has been printed in stderr

 	// check that the final selected set is the one expected
-	ASSERT_GT(s.selected_sc_set.size(), 1);
-	auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	ASSERT_GT(s2.selected_sc_set.size(), 1);
+	auto selected_sc_names = libsinsp::events::sc_set_to_event_names(s2.selected_sc_set);
 	auto expected_sc_names = strset_t({
 		// note: we expect the "read" syscall to have been erased
 		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", // from ruleset
@@ -196,31 +200,31 @@ TEST(ConfigureInterestingSets, selection_not_allevents)
 	ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);

 	// check that all IO syscalls have been erased from the selection
-	auto io_set = libsinsp::events::io_sc_set();
-	auto erased_sc_names = libsinsp::events::sc_set_to_names(io_set);
+	auto ignored_set = falco::app::ignored_sc_set();
+	auto erased_sc_names = libsinsp::events::sc_set_to_event_names(ignored_set);
 	ASSERT_NAMES_NOCONTAIN(selected_sc_names, erased_sc_names);

 	// check that final selected set is exactly sinsp state + ruleset
-	auto rule_set = s.engine->sc_codes_for_ruleset(s_sample_source, s_sample_ruleset);
+	auto rule_set = s2.engine->sc_codes_for_ruleset(s_sample_source, s_sample_ruleset);
 	auto state_set = libsinsp::events::sinsp_state_sc_set();
-	for (const auto &erased : io_set)
+	for (const auto &erased : ignored_set)
 	{
 		rule_set.remove(erased);
 		state_set.remove(erased);
 	}
 	auto union_set = state_set.merge(rule_set);
 	auto inter_set = state_set.intersect(rule_set);
-	ASSERT_EQ(s.selected_sc_set.size(), state_set.size() + rule_set.size() - inter_set.size());
-	ASSERT_EQ(s.selected_sc_set, union_set);
+	EXPECT_EQ(s2.selected_sc_set.size(), state_set.size() + rule_set.size() - inter_set.size());
+	ASSERT_EQ(s2.selected_sc_set, union_set);
 }

 TEST(ConfigureInterestingSets, selection_allevents)
 {
+	falco::app::state s3;
 	// run app action with fake engine and with the `-A` option
-	falco::app::state s;
-	s.engine = mock_engine_from_filters(s_sample_filters);
-	s.options.all_events = true;
-	auto result = falco::app::actions::configure_interesting_sets(s);
+	s3.engine = mock_engine_from_filters(s_sample_filters);
+	s3.options.all_events = true;
+	auto result = falco::app::actions::configure_interesting_sets(s3);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");

@@ -228,8 +232,8 @@ TEST(ConfigureInterestingSets, selection_allevents)
 	// also check if a warning has not been printed in stderr

 	// check that the final selected set is the one expected
-	ASSERT_GT(s.selected_sc_set.size(), 1);
-	auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	ASSERT_GT(s3.selected_sc_set.size(), 1);
+	auto selected_sc_names = libsinsp::events::sc_set_to_event_names(s3.selected_sc_set);
 	auto expected_sc_names = strset_t({
 		// note: we expect the "read" syscall to not be erased
 		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", // from ruleset
@@ -239,29 +243,29 @@ TEST(ConfigureInterestingSets, selection_allevents)
 	ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);

 	// check that final selected set is exactly sinsp state + ruleset
-	auto rule_set = s.engine->sc_codes_for_ruleset(s_sample_source, s_sample_ruleset);
+	auto rule_set = s3.engine->sc_codes_for_ruleset(s_sample_source, s_sample_ruleset);
 	auto state_set = libsinsp::events::sinsp_state_sc_set();
 	auto union_set = state_set.merge(rule_set);
 	auto inter_set = state_set.intersect(rule_set);
-	ASSERT_EQ(s.selected_sc_set.size(), state_set.size() + rule_set.size() - inter_set.size());
-	ASSERT_EQ(s.selected_sc_set, union_set);
+	EXPECT_EQ(s3.selected_sc_set.size(), state_set.size() + rule_set.size() - inter_set.size());
+	ASSERT_EQ(s3.selected_sc_set, union_set);
 }

 TEST(ConfigureInterestingSets, selection_generic_evts)
 {
+	falco::app::state s4;
 	// run app action with fake engine and without the `-A` option
-	falco::app::state s;
-	s.options.all_events = false;
+	s4.options.all_events = false;
 	auto filters = s_sample_filters;
 	filters.insert(s_sample_generic_filters.begin(), s_sample_generic_filters.end());
-	s.engine = mock_engine_from_filters(filters);
-	auto result = falco::app::actions::configure_interesting_sets(s);
+	s4.engine = mock_engine_from_filters(filters);
+	auto result = falco::app::actions::configure_interesting_sets(s4);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");

 	// check that the final selected set is the one expected
-	ASSERT_GT(s.selected_sc_set.size(), 1);
-	auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	ASSERT_GT(s4.selected_sc_set.size(), 1);
+	auto selected_sc_names = libsinsp::events::sc_set_to_event_names(s4.selected_sc_set);
 	auto expected_sc_names = strset_t({
 		// note: we expect the "read" syscall to not be erased
 		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", // from ruleset
@@ -270,7 +274,7 @@ TEST(ConfigureInterestingSets, selection_generic_evts)
 		"socket", "bind", "close" // from sinsp state set (network, files)
 	});
 	ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);
-	auto unexpected_sc_names = libsinsp::events::sc_set_to_names(libsinsp::events::io_sc_set());
+	auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(falco::app::ignored_sc_set());
 	ASSERT_NAMES_NOCONTAIN(selected_sc_names, unexpected_sc_names);
 }

@@ -281,19 +285,19 @@ TEST(ConfigureInterestingSets, selection_generic_evts)
 // - if `-A` is not set, events from the IO set are removed from the selected set
 TEST(ConfigureInterestingSets, selection_custom_base_set)
 {
+	falco::app::state s5;
 	// run app action with fake engine and without the `-A` option
-	falco::app::state s;
-	s.options.all_events = true;
-	s.engine = mock_engine_from_filters(s_sample_filters);
+	s5.options.all_events = true;
+	s5.engine = mock_engine_from_filters(s_sample_filters);
 	auto default_base_set = libsinsp::events::sinsp_state_sc_set();

 	// non-empty custom base set (both positive and negative)
-	s.config->m_base_syscalls_repair = false;
-	s.config->m_base_syscalls_custom_set = {"syncfs", "!accept"};
-	auto result = falco::app::actions::configure_interesting_sets(s);
+	s5.config->m_base_syscalls_repair = false;
+	s5.config->m_base_syscalls_custom_set = {"syncfs", "!accept"};
+	auto result = falco::app::actions::configure_interesting_sets(s5);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");
-	auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	auto selected_sc_names = libsinsp::events::sc_set_to_event_names(s5.selected_sc_set);
 	auto expected_sc_names = strset_t({
 		// note: `syncfs` has been added due to the custom base set, and `accept`
 		// has been remove due to the negative base set.
@@ -301,90 +305,127 @@ TEST(ConfigureInterestingSets, selection_custom_base_set)
 		// note: `accept` is not included even though it is matched by the rules,
 		// which means that the custom negation base set has precedence over the
 		// final selection set as a whole
-		// todo(jasondellaluce): add "accept4" once names_to_sc_set is polished on the libs side
-		"connect", "umount2", "open", "ptrace", "mmap", "execve", "read", "syncfs", "sched_process_exit"
+		// note(jasondellaluce): "accept4" should be added, however old versions
+		// of the ACCEPT4 event are actually named "accept" in the event table
+		"connect", "umount2", "open", "ptrace", "mmap", "execve", "read", "syncfs", "procexit"
 	});
 	ASSERT_NAMES_EQ(selected_sc_names, expected_sc_names);

 	// non-empty custom base set (both positive and negative with collision)
-	s.config->m_base_syscalls_repair = false;
-	s.config->m_base_syscalls_custom_set = {"syncfs", "accept", "!accept"};
-	result = falco::app::actions::configure_interesting_sets(s);
+	s5.config->m_base_syscalls_repair = false;
+	s5.config->m_base_syscalls_custom_set = {"syncfs", "accept", "!accept"};
+	result = falco::app::actions::configure_interesting_sets(s5);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");
-	selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	selected_sc_names = libsinsp::events::sc_set_to_event_names(s5.selected_sc_set);
 	// note: in case of collision, negation has priority, so the expected
 	// names are the same as the case above
 	ASSERT_NAMES_EQ(selected_sc_names, expected_sc_names);

 	// non-empty custom base set (only positive)
-	s.config->m_base_syscalls_custom_set = {"syncfs"};
-	result = falco::app::actions::configure_interesting_sets(s);
+	s5.config->m_base_syscalls_custom_set = {"syncfs"};
+	result = falco::app::actions::configure_interesting_sets(s5);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");
-	selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	selected_sc_names = libsinsp::events::sc_set_to_event_names(s5.selected_sc_set);
 	expected_sc_names = strset_t({
 		// note: accept is not negated anymore
-		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "syncfs", "sched_process_exit"
+		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "read", "syncfs", "procexit"
 	});
 	ASSERT_NAMES_EQ(selected_sc_names, expected_sc_names);

 	// non-empty custom base set (only negative)
-	s.config->m_base_syscalls_custom_set = {"!accept"};
-	result = falco::app::actions::configure_interesting_sets(s);
+	s5.config->m_base_syscalls_custom_set = {"!accept"};
+	result = falco::app::actions::configure_interesting_sets(s5);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");
-	selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	selected_sc_names = libsinsp::events::sc_set_to_event_names(s5.selected_sc_set);
 	expected_sc_names = unordered_set_union(
-		libsinsp::events::sc_set_to_names(default_base_set),
+		libsinsp::events::sc_set_to_event_names(default_base_set),
 		strset_t({ "connect", "umount2", "open", "ptrace", "mmap", "execve", "read"}));
 	expected_sc_names.erase("accept");
-	// todo(jasondellaluce): add "accept4" once names_to_sc_set is polished on the libs side
+	// note(jasondellaluce): "accept4" should be included, however old versions
+	// of the ACCEPT4 event are actually named "accept" in the event table
 	expected_sc_names.erase("accept4");
 	ASSERT_NAMES_EQ(selected_sc_names, expected_sc_names);

 	// non-empty custom base set (positive, without -A)
-	s.options.all_events = false;
-	s.config->m_base_syscalls_custom_set = {"read"};
-	result = falco::app::actions::configure_interesting_sets(s);
+	s5.options.all_events = false;
+	s5.config->m_base_syscalls_custom_set = {"read"};
+	result = falco::app::actions::configure_interesting_sets(s5);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");
-	selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	selected_sc_names = libsinsp::events::sc_set_to_event_names(s5.selected_sc_set);
 	expected_sc_names = strset_t({
 		// note: read is both part of the custom base set and the rules set,
 		// but we expect the unset -A option to take precedence
-		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "sched_process_exit"
+		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "procexit"
 	});
 	ASSERT_NAMES_EQ(selected_sc_names, expected_sc_names);
-	auto unexpected_sc_names = libsinsp::events::sc_set_to_names(libsinsp::events::io_sc_set());
+	auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(falco::app::ignored_sc_set());
 	ASSERT_NAMES_NOCONTAIN(selected_sc_names, unexpected_sc_names);
 }

 TEST(ConfigureInterestingSets, selection_custom_base_set_repair)
 {
+	falco::app::state s6;
 	// run app action with fake engine and without the `-A` option
-	falco::app::state s;
-	s.options.all_events = false;
-	s.engine = mock_engine_from_filters(s_sample_filters);
+	s6.options.all_events = false;
+	s6.engine = mock_engine_from_filters(s_sample_filters);

-	// simulate empty custom set but repair option set.
 	// note: here we use file syscalls (e.g. open, openat) and have a custom
 	// positive set, so we expect syscalls such as "close" to be selected as
 	// repaired. Also, given that we use some network syscalls, we expect "bind"
 	// to be selected event if we negate it, because repairment should have
 	// take precedence.
-	s.config->m_base_syscalls_custom_set = {"openat", "!bind"};
-	s.config->m_base_syscalls_repair = true;
-	auto result = falco::app::actions::configure_interesting_sets(s);
+	s6.config->m_base_syscalls_custom_set = {"openat", "!bind"};
+	s6.config->m_base_syscalls_repair = true;
+	auto result = falco::app::actions::configure_interesting_sets(s6);
 	ASSERT_TRUE(result.success);
 	ASSERT_EQ(result.errstr, "");
-	auto selected_sc_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+	auto selected_sc_names = libsinsp::events::sc_set_to_event_names(s6.selected_sc_set);
 	auto expected_sc_names = strset_t({
 		// note: expecting syscalls from mock rules and `sinsp_repair_state_sc_set` enforced syscalls
-		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "sched_process_exit", \
+		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "procexit", \
 		"bind", "socket", "clone3", "close", "setuid"
 	});
 	ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);
-	auto unexpected_sc_names = libsinsp::events::sc_set_to_names(libsinsp::events::io_sc_set());
+	auto unexpected_sc_names = libsinsp::events::sc_set_to_event_names(falco::app::ignored_sc_set());
 	ASSERT_NAMES_NOCONTAIN(selected_sc_names, unexpected_sc_names);
 }
+
+TEST(ConfigureInterestingSets, selection_empty_custom_base_set_repair)
+{
+	falco::app::state s7;
+	// run app action with fake engine and with the `-A` option
+	s7.options.all_events = true;
+	s7.engine = mock_engine_from_filters(s_sample_filters);
+
+	// simulate empty custom set but repair option set.
+	s7.config->m_base_syscalls_custom_set = {};
+	s7.config->m_base_syscalls_repair = true;
+	auto result = falco::app::actions::configure_interesting_sets(s7);
+	auto s7_rules_set = s7.engine->sc_codes_for_ruleset(s_sample_source, s_sample_ruleset);
+	ASSERT_TRUE(result.success);
+	ASSERT_EQ(result.errstr, "");
+	auto selected_sc_names = libsinsp::events::sc_set_to_event_names(s7.selected_sc_set);
+	auto expected_sc_names = strset_t({
+		// note: expecting syscalls from mock rules and `sinsp_repair_state_sc_set` enforced syscalls
+		"connect", "accept", "accept4", "umount2", "open", "ptrace", "mmap", "execve", "procexit", \
+		"bind", "socket", "clone3", "close", "setuid"
+	});
+	ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);
+	auto s7_state_set = libsinsp::events::sinsp_repair_state_sc_set(s7_rules_set);
+	ASSERT_EQ(s7.selected_sc_set, s7_state_set);
+	ASSERT_EQ(s7.selected_sc_set.size(), s7_state_set.size());
+}
+
+TEST(ConfigureInterestingSets, ignored_set_expected_size)
+{
+	// unit test fence to make sure we don't have unexpected regressions
+	// in the ignored set, to be updated in the future
+	ASSERT_EQ(falco::app::ignored_sc_set().size(), 14);
+
+	// we don't expect to ignore any syscall in the default base set
+	ASSERT_EQ(falco::app::ignored_sc_set().intersect(libsinsp::events::sinsp_state_sc_set()).size(), 0);
+}
--- a/unit_tests/falco/app/actions/test_select_event_sources.cpp
+++ b/unit_tests/falco/app/actions/test_select_event_sources.cpp
@@ -44,10 +44,18 @@ TEST(ActionSelectEventSources, pre_post_conditions)
        falco::app::state s;
        s.loaded_sources = {"syscall", "some_source"};
        EXPECT_ACTION_OK(action(s));
-        EXPECT_EQ(s.loaded_sources, s.enabled_sources);
-        s.loaded_sources.insert("another_source");
+        EXPECT_EQ(s.loaded_sources.size(), s.enabled_sources.size());
+        for (const auto& v : s.loaded_sources)
+        {
+            ASSERT_TRUE(s.enabled_sources.find(v) != s.enabled_sources.end());
+        }
+        s.loaded_sources.push_back("another_source");
        EXPECT_ACTION_OK(action(s));
-        EXPECT_EQ(s.loaded_sources, s.enabled_sources);
+        EXPECT_EQ(s.loaded_sources.size(), s.enabled_sources.size());
+        for (const auto& v : s.loaded_sources)
+        {
+            ASSERT_TRUE(s.enabled_sources.find(v) != s.enabled_sources.end());
+        }
    }

    // enable only selected sources
--- a/userspace/engine/evttype_index_ruleset.cpp
+++ b/userspace/engine/evttype_index_ruleset.cpp
@@ -171,8 +171,6 @@ void evttype_index_ruleset::add(
 		if(rule.source == falco_common::syscall_source)
 		{
 			wrap->sc_codes = libsinsp::filter::ast::ppm_sc_codes(condition.get());
-			// todo(jasondellaluce): once libsinsp has its fixes, optimize this
-			// by using libsinsp::events::ppm_set_to_event_set(wrap->sc_codes)
 			wrap->event_codes = libsinsp::filter::ast::ppm_event_codes(condition.get());
 		}
 		else
@@ -180,6 +178,7 @@ void evttype_index_ruleset::add(
 			wrap->sc_codes = { };
 			wrap->event_codes = { ppm_event_code::PPME_PLUGINEVENT_E };
 		}
+		wrap->event_codes.insert(ppm_event_code::PPME_ASYNCEVENT_E);
 		m_filters.insert(wrap);
 	}
 	catch (const sinsp_exception& e)
--- a/userspace/engine/falco_common.h
+++ b/userspace/engine/falco_common.h
@@ -52,7 +52,7 @@ struct falco_exception : std::exception

 namespace falco_common
 {
-	const std::string syscall_source = "syscall";
+	const std::string syscall_source = sinsp_syscall_event_source_name;

 	// Same as numbers/indices into the above vector
 	enum priority_type
--- a/userspace/engine/falco_engine.h
+++ b/userspace/engine/falco_engine.h
@@ -147,7 +147,7 @@ public:
 	// of all output expressions. You can also choose to replace
 	// %container.info with the extra information or add it to the
 	// end of the expression. This is used in open source falco to
-	// add k8s/mesos/container information to outputs when
+	// add k8s/container information to outputs when
 	// available.
 	//
 	void set_extra(std::string &extra, bool replace_container_info);
--- a/userspace/engine/falco_engine_version.h
+++ b/userspace/engine/falco_engine_version.h
@@ -21,4 +21,4 @@ limitations under the License.
 // This is the result of running "falco --list -N | sha256sum" and
 // represents the fields supported by this version of Falco. It's used
 // at build time to detect a changed set of fields.
-#define FALCO_FIELDS_CHECKSUM "8684342b994f61ca75a1a494e1197b86b53715c59ad60de3768d4d74ea4ba2c9"
+#define FALCO_FIELDS_CHECKSUM "dd438e1713ebf8abc09a2c89da77bb43ee3886ad1ba69802595a5f18e3854550"
--- a/userspace/engine/rule_loader_compiler.cpp
+++ b/userspace/engine/rule_loader_compiler.cpp
@@ -495,12 +495,10 @@ void rule_loader::compiler::compile_rule_infos(
 		}

 		// populate set of event types and emit an special warning
-		libsinsp::events::set<ppm_event_code> evttypes = { ppm_event_code::PPME_PLUGINEVENT_E };
 		if(rule.source == falco_common::syscall_source)
 		{
-			evttypes = libsinsp::filter::ast::ppm_event_codes(ast.get());
-			if ((evttypes.empty() || evttypes.size() > 100)
-			    && r.warn_evttypes)
+			auto evttypes = libsinsp::filter::ast::ppm_event_codes(ast.get());
+			if ((evttypes.empty() || evttypes.size() > 100) && r.warn_evttypes)
 			{
 				cfg.res->add_warning(
 					falco::load_result::load_result::LOAD_NO_EVTTYPE,
--- a/userspace/falco/app/actions/compute_syscall_buffer_size.cpp
+++ b/userspace/falco/app/actions/compute_syscall_buffer_size.cpp
@@ -29,7 +29,10 @@ falco::app::run_result falco::app::actions::configure_syscall_buffer_size(falco:
 	/* We don't need to compute the syscall buffer dimension if we are in capture mode or if the
 	 * the syscall source is not enabled.
 	 */
-	if(s.is_capture_mode() || s.enabled_sources.find(falco_common::syscall_source) == s.enabled_sources.end() || s.is_gvisor_enabled())
+	if(s.is_capture_mode()
+			|| !s.is_source_enabled(falco_common::syscall_source)
+			|| s.is_gvisor_enabled()
+			|| s.options.nodriver)
 	{
 		return run_result::ok();
 	}
--- a/userspace/falco/app/actions/configure_interesting_sets.cpp
+++ b/userspace/falco/app/actions/configure_interesting_sets.cpp
@@ -15,6 +15,8 @@ limitations under the License.
 */

 #include "actions.h"
+#include "helpers.h"
+#include "../app.h"

 using namespace falco::app;
 using namespace falco::app::actions;
@@ -44,7 +46,7 @@ static void check_for_rules_unsupported_events(falco::app::state& s, const libsi
 {
 	/* Unsupported events are those events that are used in the rules
 	 * but that are not part of the selected event set. For now, this
-	 * is expected to happen only for high volume I/O syscalls for
+	 * is expected to happen only for high volume syscalls for
 	 * performance reasons. */
 	auto unsupported_sc_set = rules_sc_set.diff(s.selected_sc_set);
 	if (unsupported_sc_set.empty())
@@ -53,9 +55,9 @@ static void check_for_rules_unsupported_events(falco::app::state& s, const libsi
 	}

 	/* Get the names of the events (syscall and non syscall events) that were not activated and print them. */
-	auto names = libsinsp::events::sc_set_to_names(unsupported_sc_set);
+	auto names = libsinsp::events::sc_set_to_event_names(unsupported_sc_set);
 	std::cerr << "Loaded rules match syscalls that are not activated (e.g. were removed via config settings such as no -A flag or negative base_syscalls elements) or unsupported with current configuration: warning (unsupported-evttype): " + concat_set_in_order(names) << std::endl;
-	std::cerr << "If syscalls in rules include high volume I/O syscalls (-> activate via `-A` flag), else syscalls may have been removed via base_syscalls option or might be associated with syscalls undefined on your architecture (https://marcin.juszkiewicz.com.pl/download/tables/syscalls.html)" << std::endl;
+	std::cerr << "If syscalls in rules include high volume syscalls (-> activate via `-A` flag), else syscalls may have been removed via base_syscalls option or might be associated with syscalls undefined on your architecture (https://marcin.juszkiewicz.com.pl/download/tables/syscalls.html)" << std::endl;
 }

 static void select_event_set(falco::app::state& s, const libsinsp::events::set<ppm_sc_code>& rules_sc_set)
@@ -63,7 +65,7 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set<p
 	/* PPM syscall codes (sc) can be viewed as condensed libsinsp lookup table
 	 * to map a system call name to it's actual system syscall id (as defined
 	 * by the Linux kernel). Hence here we don't need syscall enter and exit distinction. */
-	auto rules_names = libsinsp::events::sc_set_to_names(rules_sc_set);
+	auto rules_names = libsinsp::events::sc_set_to_event_names(rules_sc_set);
 	if (!rules_sc_set.empty())
 	{
 		falco_logger::log(LOG_DEBUG, "(" + std::to_string(rules_names.size())
@@ -86,8 +88,8 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set<p
 	std::unordered_set<std::string> user_positive_names = {};
 	std::unordered_set<std::string> user_negative_names = {};
 	extract_base_syscalls_names(s.config->m_base_syscalls_custom_set, user_positive_names, user_negative_names);
-	auto user_positive_sc_set = libsinsp::events::names_to_sc_set(user_positive_names);
-	auto user_negative_sc_set = libsinsp::events::names_to_sc_set(user_negative_names);
+	auto user_positive_sc_set = libsinsp::events::event_names_to_sc_set(user_positive_names);
+	auto user_negative_sc_set = libsinsp::events::event_names_to_sc_set(user_negative_names);

 	if (!user_positive_sc_set.empty())
 	{
@@ -96,7 +98,7 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set<p

 		// we re-transform from sc_set to names to make
 		// sure that bad user inputs are ignored
-		auto user_positive_sc_set_names = libsinsp::events::sc_set_to_names(user_positive_sc_set);
+		auto user_positive_sc_set_names = libsinsp::events::sc_set_to_event_names(user_positive_sc_set);
 		falco_logger::log(LOG_DEBUG, "+(" + std::to_string(user_positive_sc_set_names.size())
 			+ ") syscalls added (base_syscalls override): "
 			+ concat_set_in_order(user_positive_sc_set_names) + "\n");
@@ -132,7 +134,7 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set<p

 		// we re-transform from sc_set to names to make
 		// sure that bad user inputs are ignored
-		auto user_negative_sc_set_names = libsinsp::events::sc_set_to_names(user_negative_sc_set);
+		auto user_negative_sc_set_names = libsinsp::events::sc_set_to_event_names(user_negative_sc_set);
 		falco_logger::log(LOG_DEBUG, "-(" + std::to_string(user_negative_sc_set_names.size())
 			+ ") syscalls removed (base_syscalls override): "
 			+ concat_set_in_order(user_negative_sc_set_names) + "\n");
@@ -150,7 +152,7 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set<p
 	auto non_rules_sc_set = s.selected_sc_set.diff(rules_sc_set);
 	if (!non_rules_sc_set.empty() && user_positive_sc_set.empty())
 	{
-		auto non_rules_sc_set_names = libsinsp::events::sc_set_to_names(non_rules_sc_set);
+		auto non_rules_sc_set_names = libsinsp::events::sc_set_to_event_names(non_rules_sc_set);
 		falco_logger::log(LOG_DEBUG, "+(" + std::to_string(non_rules_sc_set_names.size())
 			+ ") syscalls (Falco's state engine set of syscalls): "
 			+ concat_set_in_order(non_rules_sc_set_names) + "\n");
@@ -158,17 +160,17 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set<p

 	/* -A flag behavior:
 	 * (1) default: all syscalls in rules included, sinsp state enforcement
-	       without high volume I/O syscalls
+	       without high volume syscalls
 	 * (2) -A flag set: all syscalls in rules included, sinsp state enforcement
-	       and allowing high volume I/O syscalls */
+	       and allowing high volume syscalls */
 	if(!s.options.all_events)
 	{
-		auto ignored_sc_set = libsinsp::events::io_sc_set();
+		auto ignored_sc_set = falco::app::ignored_sc_set();
 		auto erased_sc_set = s.selected_sc_set.intersect(ignored_sc_set);
 		s.selected_sc_set = s.selected_sc_set.diff(ignored_sc_set);
 		if (!erased_sc_set.empty())
 		{
-			auto erased_sc_set_names = libsinsp::events::sc_set_to_names(erased_sc_set);
+			auto erased_sc_set_names = libsinsp::events::sc_set_to_event_names(erased_sc_set);
 			falco_logger::log(LOG_DEBUG, "-(" + std::to_string(erased_sc_set_names.size())
 				+ ") ignored syscalls (-> activate via `-A` flag): "
 				+ concat_set_in_order(erased_sc_set_names) + "\n");
@@ -188,7 +190,7 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set<p
 		auto repaired_sc_set = s.selected_sc_set.diff(selected_sc_set);
 		if (!repaired_sc_set.empty())
 		{
-			auto repaired_sc_set_names = libsinsp::events::sc_set_to_names(repaired_sc_set);
+			auto repaired_sc_set_names = libsinsp::events::sc_set_to_event_names(repaired_sc_set);
 			falco_logger::log(LOG_INFO, "+(" + std::to_string(repaired_sc_set_names.size())
 				+ ") repaired syscalls: " + concat_set_in_order(repaired_sc_set_names) + "\n");
 		}
@@ -203,7 +205,7 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set<p

 	if (!s.selected_sc_set.empty())
 	{
-		auto selected_sc_set_names = libsinsp::events::sc_set_to_names(s.selected_sc_set);
+		auto selected_sc_set_names = libsinsp::events::sc_set_to_event_names(s.selected_sc_set);
 		falco_logger::log(LOG_DEBUG, "(" + std::to_string(selected_sc_set_names.size())
 			+ ") syscalls selected in total (final set): "
 			+ concat_set_in_order(selected_sc_set_names) + "\n");
--- a/userspace/falco/app/actions/create_requested_paths.cpp
+++ b/userspace/falco/app/actions/create_requested_paths.cpp
@@ -33,7 +33,7 @@ static int create_dir(const std::string &path);

 falco::app::run_result falco::app::actions::create_requested_paths(falco::app::state& s)
 {
-	if(!s.options.gvisor_config.empty())
+	if(s.is_gvisor_enabled())
 	{
 		// This is bad: parsing gvisor config to get endpoint
 		// to be able to auto-create the path to the file for the user.
--- a/userspace/falco/app/actions/helpers_generic.cpp
+++ b/userspace/falco/app/actions/helpers_generic.cpp
@@ -41,12 +41,45 @@ void falco::app::actions::print_enabled_event_sources(falco::app::state& s)
 {
 	/* Print all enabled sources. */
 	std::string str;
-	for (const auto &s : s.enabled_sources)
+	for (const auto &src : s.enabled_sources)
 	{
 		str += str.empty() ? "" : ", ";
-		str += s;
+		str += src;
+	}
+	falco_logger::log(LOG_INFO, "Enabled event sources: " + str);
+
+	// print some warnings to the user
+	for (const auto& src : s.enabled_sources)
+	{
+		std::shared_ptr<sinsp_plugin> first_plugin = nullptr;
+		const auto& plugins = s.offline_inspector->get_plugin_manager()->plugins();
+		for (const auto& p : plugins)
+		{
+			if ((p->caps() & CAP_SOURCING)
+					&& ((p->id() != 0 && src == p->event_source())
+						|| (p->id() == 0 && src == falco_common::syscall_source)))
+			{
+				if (first_plugin == nullptr)
+				{
+					first_plugin = p;
+				}
+				else
+				{
+					if (src != falco_common::syscall_source || s.options.nodriver)
+					{
+						falco_logger::log(LOG_WARNING, "Enabled event source '"
+							+ src + "' can be opened with multiple loaded plugins, will use only '"
+							+ first_plugin->name() + "'");
+					}
+				}
+			}
+		}
+		if (!first_plugin && s.options.nodriver)
+		{
+			falco_logger::log(LOG_WARNING, "Enabled event source '"
+				+ src + "' will be opened with no driver, no event will be produced");
+		}
 	}
-	falco_logger::log(LOG_INFO, "Enabled event sources: " + str + "\n");
 }

 void falco::app::actions::format_plugin_info(std::shared_ptr<sinsp_plugin> p, std::ostream& os)
@@ -58,8 +91,13 @@ void falco::app::actions::format_plugin_info(std::shared_ptr<sinsp_plugin> p, st
 	os << "Capabilities: " << std::endl;
 	if(p->caps() & CAP_SOURCING)
 	{
-		os << "  - Event Sourcing (ID=" << p->id();
-		os << ", source='" << p->event_source() << "')" << std::endl;
+		os << "  - Event Sourcing";
+		if (p->id() != 0)
+		{
+			os << " (ID=" << p->id();
+			os << ", source='" << p->event_source() << "')";
+		}
+		os << std::endl;
 	}
 	if(p->caps() & CAP_EXTRACTION)
 	{
--- a/userspace/falco/app/actions/helpers_inspector.cpp
+++ b/userspace/falco/app/actions/helpers_inspector.cpp
@@ -53,15 +53,37 @@ falco::app::run_result falco::app::actions::open_live_inspector(
 		{
 			for (const auto& p: inspector->get_plugin_manager()->plugins())
 			{
-				if (p->caps() & CAP_SOURCING && p->event_source() == source)
+				// note: if more than one loaded plugin supports the given
+				// event source, only the first one will be opened, following
+				// the loading order specified in the Falco config.
+				if (p->caps() & CAP_SOURCING && p->id() != 0 && p->event_source() == source)
 				{
 					auto cfg = s.plugin_configs.at(p->name());
-					falco_logger::log(LOG_INFO, "Opening capture with plugin '" + cfg->m_name + "'\n");
+					falco_logger::log(LOG_INFO, "Opening '" + source + "' source with plugin '" + cfg->m_name + "'");
 					inspector->open_plugin(cfg->m_name, cfg->m_open_params);
 					return run_result::ok();
 				}
 			}
-			return run_result::fatal("Can't open inspector for plugin event source: " + source);
+			return run_result::fatal("Can't find plugin for event source: " + source);
+		}
+		else if (s.options.nodriver) /* nodriver engine. */
+		{
+			// when opening a capture with no driver, Falco will first check
+			// if a plugin is capable of generating raw events from the libscap
+			// event table (including system events), and if none is found it
+			// will use the nodriver engine.
+			for (const auto& p: inspector->get_plugin_manager()->plugins())
+			{
+				if (p->caps() & CAP_SOURCING && p->id() == 0)
+				{
+					auto cfg = s.plugin_configs.at(p->name());
+					falco_logger::log(LOG_INFO, "Opening '" + source + "' source with plugin '" + cfg->m_name + "'");
+					inspector->open_plugin(cfg->m_name, cfg->m_open_params);
+					return run_result::ok();
+				}
+			}
+			falco_logger::log(LOG_INFO, "Opening '" + source + "' source with no driver\n");
+			inspector->open_nodriver();
 		}
 		else if (s.options.userspace) /* udig engine. */
 		{
@@ -69,17 +91,17 @@ falco::app::run_result falco::app::actions::open_live_inspector(
 			//
 			// Falco uses a ptrace(2) based userspace implementation.
 			// Regardless of the implementation, the underlying method remains the same.
-			falco_logger::log(LOG_INFO, "Opening capture with udig\n");
+			falco_logger::log(LOG_INFO, "Opening '" + source + "' source with udig\n");
 			inspector->open_udig();
 		}
-		else if(!s.options.gvisor_config.empty()) /* gvisor engine. */
+		else if(s.is_gvisor_enabled()) /* gvisor engine. */
 		{
-			falco_logger::log(LOG_INFO, "Opening capture with gVisor. Configuration path: " + s.options.gvisor_config);
+			falco_logger::log(LOG_INFO, "Opening '" + source + "' source with gVisor. Configuration path: " + s.options.gvisor_config);
 			inspector->open_gvisor(s.options.gvisor_config, s.options.gvisor_root);
 		}
 		else if(s.options.modern_bpf) /* modern BPF engine. */
 		{
-			falco_logger::log(LOG_INFO, "Opening capture with modern BPF probe.");
+			falco_logger::log(LOG_INFO, "Opening '" + source + "' source with modern BPF probe.");
 			falco_logger::log(LOG_INFO, "One ring buffer every '" + std::to_string(s.config->m_cpus_for_each_syscall_buffer) +  "' CPUs.");
 			inspector->open_modern_bpf(s.syscall_buffer_bytes_size, s.config->m_cpus_for_each_syscall_buffer, true, s.selected_sc_set);
 		}
@@ -98,14 +120,14 @@ falco::app::run_result falco::app::actions::open_live_inspector(
 				snprintf(full_path, PATH_MAX, "%s/%s", home, FALCO_PROBE_BPF_FILEPATH);
 				bpf_probe_path = full_path;
 			}
-			falco_logger::log(LOG_INFO, "Opening capture with BPF probe. BPF probe path: " + std::string(bpf_probe_path));
+			falco_logger::log(LOG_INFO, "Opening '" + source + "' source with BPF probe. BPF probe path: " + std::string(bpf_probe_path));
 			inspector->open_bpf(bpf_probe_path, s.syscall_buffer_bytes_size, s.selected_sc_set);
 		}
 		else /* Kernel module (default). */
 		{
 			try
 			{
-				falco_logger::log(LOG_INFO, "Opening capture with Kernel module");
+				falco_logger::log(LOG_INFO, "Opening '" + source + "' source with Kernel module");
 				inspector->open_kmod(s.syscall_buffer_bytes_size, s.selected_sc_set);
 			}
 			catch(sinsp_exception &e)
--- a/userspace/falco/app/actions/init_clients.cpp
+++ b/userspace/falco/app/actions/init_clients.cpp
@@ -23,7 +23,7 @@ falco::app::run_result falco::app::actions::init_clients(falco::app::state& s)
 {
 #ifndef MINIMAL_BUILD
 	// k8s is useful only if the syscall source is enabled
-	if (s.enabled_sources.find(falco_common::syscall_source) == s.enabled_sources.end())
+	if (s.is_capture_mode() || !s.is_source_enabled(falco_common::syscall_source))
 	{
 		return run_result::ok();
 	}
@@ -64,27 +64,6 @@ falco::app::run_result falco::app::actions::init_clients(falco::app::state& s)
 		}
 		inspector->init_k8s_client(k8s_api_ptr, k8s_api_cert_ptr, k8s_node_name_ptr, s.options.verbose);
 	}
-
-	//
-	// DEPRECATED!
-	// Run mesos, if required
-	// todo(leogr): remove in Falco 0,.35
-	//
-	if(!s.options.mesos_api.empty())
-	{
-		// Differs from init_k8s_client in that it
-		// passes a pointer but the inspector does
-		// *not* own it and does not use it after
-		// init_mesos_client() returns.
-		falco_logger::log(LOG_WARNING, "Mesos support has been DEPRECATED and will be removed in the next version!\n");
-		inspector->init_mesos_client(&(s.options.mesos_api), s.options.verbose);
-	}
-	else if(char* mesos_api_env = getenv("FALCO_MESOS_API"))
-	{
-		falco_logger::log(LOG_WARNING, "Mesos support has been DEPRECATED and will be removed in the next version!\n");
-		std::string mesos_api_copy = mesos_api_env;
-		inspector->init_mesos_client(&mesos_api_copy, s.options.verbose);
-	}
 #endif

 	return run_result::ok();
--- a/userspace/falco/app/actions/init_falco_engine.cpp
+++ b/userspace/falco/app/actions/init_falco_engine.cpp
@@ -45,11 +45,6 @@ void configure_output_format(falco::app::state& s)
 		output_format = "k8s.ns=%k8s.ns.name k8s.pod=%k8s.pod.name container=%container.id vpid=%proc.vpid vtid=%thread.vtid";
 		replace_container_info = true;
 	}
-	else if(s.options.print_additional == "m" || s.options.print_additional == "mesos")
-	{
-		output_format = "task=%mesos.task.name container=%container.id";
-		replace_container_info = true;
-	}
 	else if(!s.options.print_additional.empty())
 	{
 		output_format = s.options.print_additional;
@@ -65,50 +60,38 @@ void configure_output_format(falco::app::state& s)
 void add_source_to_engine(falco::app::state& s, const std::string& src)
 {
 	auto src_info = s.source_infos.at(src);
-	std::shared_ptr<gen_event_filter_factory> filter_factory = nullptr;
-	std::shared_ptr<gen_event_formatter_factory> formatter_factory = nullptr;
+	auto& filterchecks = *src_info->filterchecks.get();
+	auto* inspector = src_info->inspector.get();

-	if (src == falco_common::syscall_source)
-	{
-		filter_factory = std::shared_ptr<gen_event_filter_factory>(
-			new sinsp_filter_factory(src_info->inspector.get()));
-		formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
-			new sinsp_evt_formatter_factory(src_info->inspector.get()));
-	}
-	else
-	{
-		auto &filterchecks = s.source_infos.at(src)->filterchecks;
-		filter_factory = std::shared_ptr<gen_event_filter_factory>(
-			new sinsp_filter_factory(src_info->inspector.get(), filterchecks));
-		formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
-			new sinsp_evt_formatter_factory(src_info->inspector.get(), filterchecks));
-	}
+	auto filter_factory = std::shared_ptr<gen_event_filter_factory>(
+		new sinsp_filter_factory(inspector, filterchecks));
+	auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
+		new sinsp_evt_formatter_factory(inspector, filterchecks));

 	if(s.config->m_json_output)
 	{
 		formatter_factory->set_output_format(gen_event_formatter::OF_JSON);
 	}

-	src_info->engine_idx = s.engine->add_source(
-		src, filter_factory, formatter_factory);
+	src_info->engine_idx = s.engine->add_source(src, filter_factory, formatter_factory);
 }

 falco::app::run_result falco::app::actions::init_falco_engine(falco::app::state& s)
 {
+	// add syscall as first source, this is also what each inspector do
+	// in their own list of registered event sources
+	add_source_to_engine(s, falco_common::syscall_source);
+
 	// add all non-syscall event sources in engine
 	for (const auto& src : s.loaded_sources)
 	{
+		// we skip the syscall source because we already added it
 		if (src != falco_common::syscall_source)
 		{
-			// we skip the syscall as we want it to be the one added for last
-			// in the engine. This makes the source index assignment easier.
 			add_source_to_engine(s, src);
 		}
 	}

-	// add syscall as last source
-	add_source_to_engine(s, falco_common::syscall_source);
-
 	// note: in capture mode, we can assume that the plugin source index will
 	// be the same in both the falco engine and the sinsp plugin manager.
 	// This assumption stands because the plugin manager stores sources in a
@@ -122,7 +105,7 @@ falco::app::run_result falco::app::actions::init_falco_engine(falco::app::state&
 		auto manager = s.offline_inspector->get_plugin_manager();
 		for (const auto &p : manager->plugins())
 		{
-			if (p->caps() & CAP_SOURCING)
+			if (p->caps() & CAP_SOURCING && p->id() != 0)
 			{
 				bool added = false;
 				auto source_idx = manager->source_idx_by_plugin_id(p->id(), added);
--- a/userspace/falco/app/actions/init_inspectors.cpp
+++ b/userspace/falco/app/actions/init_inspectors.cpp
@@ -58,7 +58,7 @@ static void init_syscall_inspector(falco::app::state& s, std::shared_ptr<sinsp>
 }

 static bool populate_filterchecks(
-		std::shared_ptr<sinsp> inspector,
+		const std::shared_ptr<sinsp>& inspector,
 		const std::string& source,
 		filter_check_list& filterchecks,
 		std::unordered_set<std::string>& used_plugins,
@@ -118,12 +118,10 @@ falco::app::run_result falco::app::actions::init_inspectors(falco::app::state& s
 			? s.offline_inspector
 			: std::make_shared<sinsp>();

-		// handle syscall and plugin sources differently
-		// todo(jasondellaluce): change this once we support extracting plugin fields from syscalls too
+		// do extra preparation for the syscall source
 		if (src == falco_common::syscall_source)
 		{
 			init_syscall_inspector(s, src_info->inspector);
-			continue;
 		}

 		// load and init all plugins compatible with this event source
@@ -132,7 +130,9 @@ falco::app::run_result falco::app::actions::init_inspectors(falco::app::state& s
 		{
 			std::shared_ptr<sinsp_plugin> plugin = nullptr;
 			auto config = s.plugin_configs.at(p->name());
-			auto is_input = p->caps() & CAP_SOURCING && p->event_source() == src;
+			auto is_input = (p->caps() & CAP_SOURCING)
+				&& ((p->id() != 0 && src == p->event_source())
+					|| (p->id() == 0 && src == falco_common::syscall_source));

 			if (s.is_capture_mode())
 			{
@@ -146,7 +146,10 @@ falco::app::run_result falco::app::actions::init_inspectors(falco::app::state& s
 				// event source, we must register the plugin supporting
 				// that event source and also plugins with field extraction
 				// capability that are compatible with that event source
-				if (is_input || (p->caps() & CAP_EXTRACTION && p->is_source_compatible(src)))
+				if (is_input
+					|| (p->caps() & CAP_EXTRACTION && sinsp_plugin::is_source_compatible(p->extract_event_sources(), src))
+					|| (p->caps() & CAP_PARSING && sinsp_plugin::is_source_compatible(p->parse_event_sources(), src))
+					|| (p->caps() & CAP_ASYNC && sinsp_plugin::is_source_compatible(p->async_event_sources(), src)))
 				{
 					plugin = src_info->inspector->register_plugin(config->m_library_path);
 				}
@@ -156,14 +159,19 @@ falco::app::run_result falco::app::actions::init_inspectors(falco::app::state& s
 			// (in capture mode, this is true for every plugin)
 			if (plugin)
 			{
-				if (!plugin->init(config->m_init_config, err))
+				// avoid initializing the same plugin twice in the same
+				// inspector if we're in capture mode
+				if (!s.is_capture_mode() || used_plugins.find(p->name()) == used_plugins.end())
 				{
-					return run_result::fatal(err);
+					if (!plugin->init(config->m_init_config, err))
+					{
+						return run_result::fatal(err);
+					}
 				}
 				if (is_input)
 				{
 					auto gen_check = src_info->inspector->new_generic_filtercheck();
-					src_info->filterchecks.add_filter_check(gen_check);
+					src_info->filterchecks->add_filter_check(gen_check);
 				}
 				used_plugins.insert(plugin->name());
 			}
@@ -173,24 +181,20 @@ falco::app::run_result falco::app::actions::init_inspectors(falco::app::state& s
 		if (!populate_filterchecks(
 				src_info->inspector,
 				src,
-				src_info->filterchecks,
+				*src_info->filterchecks.get(),
 				used_plugins,
 				err))
 		{
 			return run_result::fatal(err);
-		}	
-
+		}
 	}

-	// check if some plugin with field extraction capability remains unused
+	// check if some plugin remains unused
 	for (const auto& p : all_plugins)
 	{
-		if(used_plugins.find(p->name()) == used_plugins.end() 
-			&& p->caps() & CAP_EXTRACTION
-			&& !(p->caps() & CAP_SOURCING && p->is_source_compatible(p->event_source())))
+		if (used_plugins.find(p->name()) == used_plugins.end())
 		{
-			return run_result::fatal("Plugin '" + p->name()
-				+ "' has field extraction capability but is not compatible with any known event source");
+			return run_result::fatal("Plugin '" + p->name() + "' is loaded but unused as not compatible with any known event source");
 		}
 	}

--- a/userspace/falco/app/actions/load_plugins.cpp
+++ b/userspace/falco/app/actions/load_plugins.cpp
@@ -28,12 +28,12 @@ falco::app::run_result falco::app::actions::load_plugins(falco::app::state& s)
 		return run_result::fatal("Can not load/use plugins with musl optimized build");
 	}
 #endif
-	auto empty_src_info = state::source_info{};
-
 	// Initialize the set of loaded event sources. 
 	// By default, the set includes the 'syscall' event source
+	state::source_info syscall_src_info;
+	syscall_src_info.filterchecks.reset(new sinsp_filter_check_list());
 	s.source_infos.clear();
-	s.source_infos.insert(empty_src_info, falco_common::syscall_source);
+	s.source_infos.insert(syscall_src_info, falco_common::syscall_source);
 	s.loaded_sources = { falco_common::syscall_source };

 	// Initialize map of plugin configs
@@ -51,11 +51,17 @@ falco::app::run_result falco::app::actions::load_plugins(falco::app::state& s)
 		falco_logger::log(LOG_INFO, "Loading plugin '" + p.m_name + "' from file " + p.m_library_path + "\n");
 		auto plugin = s.offline_inspector->register_plugin(p.m_library_path);
 		s.plugin_configs.insert(p, plugin->name());
-		if(plugin->caps() & CAP_SOURCING)
+		if(plugin->caps() & CAP_SOURCING && plugin->id() != 0)
 		{
+			state::source_info src_info;
+			src_info.filterchecks.reset(new filter_check_list());
 			auto sname = plugin->event_source();
-			s.source_infos.insert(empty_src_info, sname);
-			s.loaded_sources.insert(sname);
+			s.source_infos.insert(src_info, sname);
+			// note: this avoids duplicate values
+			if (std::find(s.loaded_sources.begin(), s.loaded_sources.end(), sname) == s.loaded_sources.end())
+			{
+				s.loaded_sources.push_back(sname);
+			}
 		}
 	}

--- a/userspace/falco/app/actions/load_rules_files.cpp
+++ b/userspace/falco/app/actions/load_rules_files.cpp
@@ -116,14 +116,6 @@ falco::app::run_result falco::app::actions::load_rules_files(falco::app::state&
 		s.engine->enable_rule_by_tag(s.options.enabled_rule_tags, true);
 	}

-	if(s.options.all_events && s.options.modern_bpf)
-	{
-		/* Right now the modern BPF probe doesn't support the -A flag, we implemented just 
-		 * the "simple set" syscalls.
-		 */
-		falco_logger::log(LOG_INFO, "The '-A' flag has no effect with the modern BPF probe, no further syscalls will be added\n");
-	}
-
 	if (s.options.describe_all_rules)
 	{
 		s.engine->describe_rule(NULL);
--- a/userspace/falco/app/actions/print_ignored_events.cpp
+++ b/userspace/falco/app/actions/print_ignored_events.cpp
@@ -16,6 +16,7 @@ limitations under the License.

 #include "actions.h"
 #include "helpers.h"
+#include "../app.h"

 using namespace falco::app;
 using namespace falco::app::actions;
@@ -27,8 +28,8 @@ falco::app::run_result falco::app::actions::print_ignored_events(falco::app::sta
 		return run_result::ok();
 	}

-	std::cout << "Ignored I/O syscall(s):" << std::endl;
-	for(const auto& it : libsinsp::events::sc_set_to_names(libsinsp::events::io_sc_set()))
+	std::cout << "Ignored syscall(s):" << std::endl;
+	for(const auto& it : libsinsp::events::sc_set_to_event_names(falco::app::ignored_sc_set()))
 	{
 		std::cout << "- " << it.c_str() << std::endl;
 	}
--- a/userspace/falco/app/actions/process_events.cpp
+++ b/userspace/falco/app/actions/process_events.cpp
@@ -140,15 +140,14 @@ static falco::app::run_result do_inspect(
 	uint64_t duration_start = 0;
 	uint32_t timeouts_since_last_success_or_msg = 0;
 	token_bucket rate_limiter;
-	bool rate_limiter_enabled = s.config->m_notifications_rate > 0;
-	bool source_engine_idx_found = false;
-	bool is_capture_mode = source.empty();
-	bool syscall_source_engine_idx = s.source_infos.at(falco_common::syscall_source)->engine_idx;
-	std::size_t source_engine_idx = 0;
-	std::vector<std::string> source_names = inspector->get_plugin_manager()->sources();
-	source_names.push_back(falco_common::syscall_source);
+	const bool rate_limiter_enabled = s.config->m_notifications_rate > 0;
+	const bool is_capture_mode = source.empty();
+	size_t source_engine_idx = 0;
+
 	if (!is_capture_mode)
 	{
+		// note: in live mode, each inspector gets assigned a distinct event
+		// source that does not change for the whole capture.
 		source_engine_idx = s.source_infos.at(source)->engine_idx;
 	}

@@ -260,24 +259,37 @@ static falco::app::run_result do_inspect(
 		// if we are in live mode, we already have the right source engine idx
 		if (is_capture_mode)
 		{
-			source_engine_idx = syscall_source_engine_idx;
-			if (ev->get_type() == PPME_PLUGINEVENT_E)
+			// note: here we can assume that the source index will be the same
+			// in both the falco engine and the inspector. See the
+			// comment in init_falco_engine.cpp for more details.
+			source_engine_idx = ev->get_source_idx();
+			if (source_engine_idx == sinsp_no_event_source_idx)
 			{
-				// note: here we can assume that the source index will be the same
-				// in both the falco engine and the sinsp plugin manager. See the
-				// comment in init_falco_engine.cpp for more details.
-				source_engine_idx = inspector->get_plugin_manager()->source_idx_by_plugin_id(*(int32_t *)ev->get_param(0)->m_val, source_engine_idx_found);
-				if (!source_engine_idx_found)
+				std::string msg = "Unknown event source for inspector's event";
+				if (ev->get_type() == PPME_PLUGINEVENT_E)
 				{
-					return run_result::fatal("Unknown plugin ID in inspector: " + std::to_string(*(int32_t *)ev->get_param(0)->m_val));
+					auto pluginID = *(int32_t *)ev->get_param(0)->m_val;
+					msg += " (plugin ID: " + std::to_string(pluginID) + ")";
 				}
+				return run_result::fatal(msg);
 			}
-
+	
 			// for capture mode, the source name can change at every event
-			stats_collector.collect(inspector, source_names[source_engine_idx]);
+			stats_collector.collect(inspector, inspector->event_sources()[source_engine_idx]);
 		}
 		else
 		{
+			// in live mode, each inspector gets assigned a distinct event source,
+			// so we report an error if we fetch an event of a different source.
+			if (source_engine_idx != ev->get_source_idx())
+			{
+				auto msg = "Unexpected event source for inspector's event: expected='" + source + "', actual=";
+				msg += (ev->get_source_name() != NULL)
+					? ("'" + std::string(ev->get_source_name()) + "'")
+					: ("<NA>");
+				return run_result::fatal(msg);
+			}
+
 			// for live mode, the source name is constant
 			stats_collector.collect(inspector, source);
 		}
--- a/userspace/falco/app/actions/select_event_sources.cpp
+++ b/userspace/falco/app/actions/select_event_sources.cpp
@@ -22,7 +22,7 @@ using namespace falco::app::actions;

 falco::app::run_result falco::app::actions::select_event_sources(falco::app::state& s)
 {
-	s.enabled_sources = s.loaded_sources;
+	s.enabled_sources = { s.loaded_sources.begin(), s.loaded_sources.end() };

 	// event sources selection is meaningless when reading trace files
 	if (s.is_capture_mode())
@@ -40,7 +40,7 @@ falco::app::run_result falco::app::actions::select_event_sources(falco::app::sta
 		s.enabled_sources.clear();
 		for(const auto &src : s.options.enable_sources)
 		{
-			if (s.loaded_sources.find(src) == s.loaded_sources.end())
+			if (std::find(s.loaded_sources.begin(), s.loaded_sources.end(), src) == s.loaded_sources.end())
 			{
 				return run_result::fatal("Attempted enabling an unknown event source: " + src);
 			}
@@ -51,7 +51,7 @@ falco::app::run_result falco::app::actions::select_event_sources(falco::app::sta
 	{
 		for(const auto &src : s.options.disable_sources)
 		{
-			if (s.loaded_sources.find(src) == s.loaded_sources.end())
+			if (std::find(s.loaded_sources.begin(), s.loaded_sources.end(), src) == s.loaded_sources.end())
 			{
 				return run_result::fatal("Attempted disabling an unknown event source: " + src);
 			}
--- a/userspace/falco/app/app.cpp
+++ b/userspace/falco/app/app.cpp
@@ -25,6 +25,15 @@ falco::atomic_signal_handler falco::app::g_reopen_outputs_signal;

 using app_action = std::function<falco::app::run_result(falco::app::state&)>;

+libsinsp::events::set<ppm_sc_code> falco::app::ignored_sc_set()
+{
+	// we ignore all the I/O syscalls that can have very high throughput and
+	// that can badly impact performance. Of those, we avoid ignoring the
+	// ones that are part of the base set used by libsinsp for maintaining
+	// its internal state.
+	return libsinsp::events::io_sc_set().diff(libsinsp::events::sinsp_state_sc_set());
+}
+
 bool falco::app::run(int argc, char** argv, bool& restart, std::string& errstr)
 {
 	falco::app::state s;    
--- a/userspace/falco/app/app.h
+++ b/userspace/falco/app/app.h
@@ -23,7 +23,10 @@ limitations under the License.
 namespace falco {
 namespace app {

+libsinsp::events::set<ppm_sc_code> ignored_sc_set();
+
 bool run(int argc, char** argv, bool& restart, std::string& errstr);
+
 bool run(falco::app::state& s, bool& restart, std::string& errstr);

 }; // namespace app
--- a/userspace/falco/app/options.cpp
+++ b/userspace/falco/app/options.cpp
@@ -36,7 +36,9 @@ options::options()
 	  list_plugins(false),
 	  list_syscall_events(false),
 	  markdown(false),
-	  modern_bpf(false)
+	  modern_bpf(false),
+	  dry_run(false),
+	  nodriver(false)
 {
 }

@@ -147,6 +149,19 @@ bool options::parse(int argc, char **argv, std::string &errstr)

 	list_fields = m_cmdline_parsed.count("list") > 0 ? true : false;

+	int open_modes = 0;
+	open_modes += !trace_filename.empty();
+	open_modes += userspace;
+	open_modes += !gvisor_config.empty();
+	open_modes += modern_bpf;
+	open_modes += getenv("FALCO_BPF_PROBE") != NULL;
+	open_modes += nodriver;
+	if (open_modes > 1)
+	{
+		errstr = std::string("You can not specify more than one of -e, -u (--userspace), -g (--gvisor-config), --modern-bpf, --nodriver, and the FALCO_BPF_PROBE env var");
+		return false;
+	}
+
 	return true;
 }

@@ -164,7 +179,7 @@ void options::define(cxxopts::Options& opts)
 #else
 		("c",                             "Configuration file. If not specified tries " FALCO_SOURCE_CONF_FILE ", " FALCO_INSTALL_CONF_FILE ".", cxxopts::value(conf_filename), "<path>")
 #endif
-		("A",                             "Monitor each event defined in rules and configs + high volume I/O syscalls. Please use the -i option to list the I/O syscalls Falco supports. This option affects live captures only. Setting -A can impact performance.", cxxopts::value(all_events)->default_value("false"))
+		("A",                             "Monitor all events supported by Falco defined in rules and configs. Please use the -i option to list the events ignored by default without -A. This option affects live captures only. Setting -A can impact performance.", cxxopts::value(all_events)->default_value("false"))
 		("b,print-base64",                "Print data buffers in base64. This is useful for encoding binary data that needs to be used over media designed to consume this format.")
 		("cri",                           "Path to CRI socket for container metadata. Use the specified socket to fetch data from a CRI-compatible runtime. If not specified, uses the libs default. This option can be passed multiple times to specify socket to be tried until a successful one is found.", cxxopts::value(cri_socket_paths), "<path>")
 		("d,daemon",                      "Run as a daemon.", cxxopts::value(daemon)->default_value("false"))
@@ -180,9 +195,9 @@ void options::define(cxxopts::Options& opts)
 		("gvisor-root",					  "gVisor root directory for storage of container state. Equivalent to runsc --root flag.", cxxopts::value(gvisor_root), "<gvisor_root>")
 #endif
 #ifdef HAS_MODERN_BPF
-		("modern-bpf",				  "[EXPERIMENTAL] Use BPF modern probe to capture system events.", cxxopts::value(modern_bpf)->default_value("false"))
+		("modern-bpf",				  "Use BPF modern probe to capture system events.", cxxopts::value(modern_bpf)->default_value("false"))
 #endif
-		("i",                             "Print all high volume I/O syscalls that are ignored by default (i.e. without the -A flag) and exit.", cxxopts::value(print_ignored_events)->default_value("false"))
+		("i",                             "Print all high volume syscalls that are ignored by default for performance reasons (i.e. without the -A flag) and exit.", cxxopts::value(print_ignored_events)->default_value("false"))
 #ifndef MINIMAL_BUILD
 		("k,k8s-api",                     "Enable Kubernetes support by connecting to the API server specified as argument. E.g. \"http://admin:password@127.0.0.1:8080\". The API server can also be specified via the environment variable FALCO_K8S_API.", cxxopts::value(k8s_api), "<url>")
 		("K,k8s-api-cert",                "Use the provided files names to authenticate user and (optionally) verify the K8S API server identity. Each entry must specify full (absolute, or relative to the current directory) path to the respective file. Private key password is optional (needed only if key is password protected). CA certificate is optional. For all files, only PEM file format is supported. Specifying CA certificate only is obsoleted - when single entry is provided for this option, it will be interpreted as the name of a file containing bearer token. Note that the format of this command-line option prohibits use of files whose names contain ':' or '#' characters in the file name.", cxxopts::value(k8s_api_cert), "(<bt_file> | <cert_file>:<key_file[#password]>[:<ca_cert_file>])")
@@ -194,13 +209,11 @@ void options::define(cxxopts::Options& opts)
 		("list-syscall-events",  		  "List all defined system call events.", cxxopts::value<bool>(list_syscall_events))
 #ifndef MUSL_OPTIMIZED
 		("list-plugins",                  "Print info on all loaded plugins and exit.", cxxopts::value(list_plugins)->default_value("false"))
-#endif
-#ifndef MINIMAL_BUILD
-		("m,mesos-api",                   "This feature has been DEPRECATED and will be removed in the next version.", cxxopts::value(mesos_api), "<url[,marathon_url]>")
 #endif
 		("M",                             "Stop collecting after <num_seconds> reached.", cxxopts::value(duration_to_tot)->default_value("0"), "<num_seconds>")
 		("markdown",                      "When used with --list/--list-syscall-events, print the content in Markdown format", cxxopts::value<bool>(markdown))
 		("N",                             "When used with --list, only print field names.", cxxopts::value(names_only)->default_value("false"))
+		("nodriver",                      "Capture for system events without drivers. If a loaded plugin has event sourcing capability and can produce system events, it will be used to for event collection.", cxxopts::value(nodriver)->default_value("false"))
 		("o,option",                      "Set the value of option <opt> to <val>. Overrides values in configuration file. <opt> can be identified using its location in configuration file using dot notation. Elements which are entries of lists can be accessed via square brackets [].\n    E.g. base.id = val\n         base.subvalue.subvalue2 = val\n         base.list[1]=val", cxxopts::value(cmdline_config_options), "<opt>=<val>")
 		("plugin-info",                   "Print info for a single plugin and exit.\nThis includes all descriptivo info like name and author, along with the\nschema format for the init configuration and a list of suggested open parameters.\n<plugin_name> can be the name of the plugin or its configured library_path.", cxxopts::value(print_plugin_info), "<plugin_name>")
 		("p,print",                       "Add additional information to each falco notification's output.\nWith -pc or -pcontainer will use a container-friendly format.\nWith -pk or -pkubernetes will use a kubernetes-friendly format.\nAdditionally, specifying -pc/-pk will change the interpretation of %container.info in rule output fields.", cxxopts::value(print_additional), "<output_format>")
--- a/userspace/falco/app/options.h
+++ b/userspace/falco/app/options.h
@@ -63,7 +63,6 @@ public:
 	std::string print_plugin_info;
 	bool list_syscall_events;
 	bool markdown;
-	std::string mesos_api;
 	int duration_to_tot;
 	bool names_only;
 	std::vector<std::string> cmdline_config_options;
@@ -85,6 +84,7 @@ public:
 	bool print_page_size;
 	bool modern_bpf;
 	bool dry_run;
+	bool nodriver;

 	bool parse(int argc, char **argv, std::string &errstr);

--- a/userspace/falco/app/state.h
+++ b/userspace/falco/app/state.h
@@ -47,12 +47,21 @@ struct state
    // Holds the info mapped for each loaded event source
    struct source_info
    {
+        source_info():
+            engine_idx(-1),
+            filterchecks(new filter_check_list()),
+            inspector(nullptr) { }
+        source_info(source_info&&) = default;
+        source_info& operator = (source_info&&) = default;
+        source_info(const source_info&) = default;
+        source_info& operator = (const source_info&) = default;
+    
        // The index of the given event source in the state's falco_engine,
        // as returned by falco_engine::add_source
        std::size_t engine_idx;
        // The filtercheck list containing all fields compatible
        // with the given event source
-        filter_check_list filterchecks;
+        std::shared_ptr<filter_check_list> filterchecks;
        // The inspector assigned to this event source. If in capture mode,
        // all event source will share the same inspector. If the event
        // source is a plugin one, the assigned inspector must have that
@@ -98,8 +107,10 @@ struct state
    std::shared_ptr<falco_engine> engine;

    // The set of loaded event sources (by default, the syscall event
-    // source plus all event sources coming from the loaded plugins)
-    std::unordered_set<std::string> loaded_sources;
+    // source plus all event sources coming from the loaded plugins).
+    // note: this has to be a vector to preserve the loading order,
+    // however it's not supposed to contain duplicate values.
+    std::vector<std::string> loaded_sources;

    // The set of enabled event sources (can be altered by using
    // the --enable-source and --disable-source options)
@@ -142,6 +153,11 @@ struct state
    {
        return !options.gvisor_config.empty();
    }
+    
+    inline bool is_source_enabled(const std::string& src) const 
+    {
+        return enabled_sources.find(falco_common::syscall_source) != enabled_sources.end();
+    }
 };

 }; // namespace app
--- a/userspace/falco/configuration.cpp
+++ b/userspace/falco/configuration.cpp
@@ -58,8 +58,10 @@ falco_configuration::falco_configuration():
 	m_metadata_download_watch_freq_sec(1),
 	m_syscall_buf_size_preset(4),
 	m_cpus_for_each_syscall_buffer(2),
-	m_syscall_drop_failed_exit(false)
+	m_syscall_drop_failed_exit(false),
+	m_base_syscalls_repair(false)
 {
+	init({});
 }

 void falco_configuration::init(const std::vector<std::string>& cmdline_options)
@@ -336,11 +338,11 @@ void falco_configuration::load_yaml(const std::string& config_name, const yaml_h
 	config.get_sequence<std::unordered_set<std::string>>(m_base_syscalls_custom_set, std::string("base_syscalls.custom_set"));
 	m_base_syscalls_repair = config.get_scalar<bool>("base_syscalls.repair", false);

-	std::set<std::string> load_plugins;
+	std::vector<std::string> load_plugins;

 	bool load_plugins_node_defined = config.is_defined("load_plugins");

-	config.get_sequence<std::set<std::string>>(load_plugins, "load_plugins");
+	config.get_sequence<std::vector<std::string>>(load_plugins, "load_plugins");

 	std::list<falco_configuration::plugin_config> plugins;
 	try
@@ -358,14 +360,32 @@ void falco_configuration::load_yaml(const std::string& config_name, const yaml_h

 	// If load_plugins was specified, only save plugins matching those in values
 	m_plugins.clear();
-	for (auto &p : plugins)
+	if (!load_plugins_node_defined)
 	{
-		// If load_plugins was not specified at all, every
-		// plugin is added. Otherwise, the plugin must be in
-		// the load_plugins list.
-		if(!load_plugins_node_defined || load_plugins.find(p.m_name) != load_plugins.end())
+		// If load_plugins was not specified at all, every plugin is added.
+		// The loading order is the same as the sequence in the YAML config.
+		m_plugins = { plugins.begin(), plugins.end() };
+	}
+	else
+	{
+		// If load_plugins is specified, only plugins contained in its list
+		// are added, with the same order as in the list.
+		for (const auto& pname : load_plugins)
 		{
-			m_plugins.push_back(p);
+			bool found = false;
+			for (const auto& p : plugins)
+			{
+				if (pname == p.m_name)
+				{
+					m_plugins.push_back(p);
+					found = true;
+					break;
+				}
+			}
+			if (!found)
+			{
+				throw std::logic_error("Cannot load plugin '" + pname + "': plugin config not found for given name");
+			}
 		}
 	}
Author	SHA1	Message	Date
Jason Dellaluce	2818f0906e	update(cmake): bump plugins to latest dev versions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	c603055acf	fix(userspace/engine): don't count async event for evttype warning Co-authored-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	2d53fed0b8	update(cmake): bump libs to 2e9e6346eefeddd0afce7b6a06cb42d4265615dd Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	4fab0d5e38	update(cmake): bump libs to 8f52cdc56fce7ff95adaaa58eeb706da244bf0ce Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	81c6564636	fix(ci): solve CI issues Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	0026471714	update(cmake): bump plugins to dev versions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	71e991b606	update(cmake): bump libs to b596458acb265028dbf0505ca45111e464470b4d Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	bb04892baf	fix(userspace/falco): avoid double plugin initializations Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	9df72e0f2a	fix(userspace/falco/app): properly populate filtercheck lists Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	4e8d1f025c	fix(userspace/falco/app): skip unnecessary app steps Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	9bfce8cfae	update(userspace): make sure that async event is always matched in rules Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	26d9448ba7	fix(ci): set cmake build type in Falco build jobs Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	fe299a0c9b	update(cmake): bump driver to 5.0.0+driver Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	733ea88ab3	fix(userspace/falco): properly init configuration Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	b2615de062	new(userspace/falco/app): print a warning if multiple plugins for same source are loaded Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	0649be619b	update(userspace/falco/app): support nodriver open mode and plugins sourcing system events Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	301c4efeb7	update(userspace/falco): support new plugin API definitions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	5175a04c6b	update(userspace/engine): bump engine checksum Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	3681cacda1	new(userspace/falco): add new --nodriver option Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	6c7754729b	update(CMakeLists): fix c++17 compilation issues Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	0e4595596e	update(cmake): bump libs and driver to 0b9ca98fee2453a16f4538db55dcfa34bc8f5aef Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Stanley Chan	3403225d8d	cleanup(docs): remove extraneous whitespace in falco.yaml Signed-off-by: Stanley Chan <pocketgamer5000@gmail.com>	2023-05-18 15:49:03 +02:00
Stanley Chan	1125b92fc3	docs: improve documentation and description of base_syscalls option Co-authored-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com> Signed-off-by: Stanley Chan <pocketgamer5000@gmail.com>	2023-05-18 15:49:03 +02:00
Aizhamal Nurmamat kyzy	52fe77cf5c	Update brand/README.md Adding the proper link to the brand guides Co-authored-by: Leonardo Grasso <me@leonardograsso.com> Signed-off-by: Aizhamal Nurmamat kyzy <aizhamal@google.com>	2023-05-18 15:24:04 +02:00
Aizhamal Nurmamat kyzy	47cb32998e	Adding back the information on Falco branding. Signed-off-by: Aizhamal Nurmamat kyzy <aizhamal@sysdig.com>	2023-05-18 15:24:04 +02:00
Aizhamal Nurmamat kyzy	455e4346cd	Update brand/README.md Co-authored-by: Leonardo Grasso <me@leonardograsso.com> Signed-off-by: Aizhamal Nurmamat kyzy <aizhamal@google.com>	2023-05-18 15:24:04 +02:00
Aizhamal Nurmamat kyzy	67993c8fa3	Updating Falco branding guidelines Signed-off-by: Aizhamal Nurmamat kyzy <aizhamal@sysdig.com>	2023-05-18 15:24:04 +02:00
dependabot[bot]	6f198556be	build(deps): Bump submodules/falcosecurity-rules Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `f773578` to `6da15ae`. - [Release notes](https://github.com/falcosecurity/rules/releases) - [Commits](`f7735788b1...6da15ae98c`) --- updated-dependencies: - dependency-name: submodules/falcosecurity-rules dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2023-05-18 09:11:03 +02:00
Andrea Terzolo	696fa43dc2	cleanup(actions): now modern bpf support `-A` flag Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-05-17 12:19:00 +02:00
Federico Di Pierro	7414c2d161	fix(ci): properly pass FALCO_VERSION loaded from extern to docker build for centos7 and arm64 builds. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-05-17 12:16:00 +02:00
Federico Di Pierro	9c483adafa	fix(cmake): properly exclude prereleases when fetching latest tag from cmake. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-05-17 12:16:00 +02:00
Federico Di Pierro	577bccabd0	new(scripts): updated falco-driver-loader to properly support talos. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-05-16 16:49:55 +02:00
Luca Guerra	09b5cb7c7b	fix(ci): load falco image before building falco-driver-loader Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-15 15:35:24 +02:00
Luca Guerra	92f884e070	new(ci): sign releases with cosign Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-12 16:03:43 +02:00
Luca Guerra	60a006f0b1	fix(ci): correctly tag slim manifest Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-12 14:27:42 +02:00
Luca Guerra	ea0b44dc56	fix(ci): simplify and fix multi-arch image publishing process Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-12 12:28:43 +02:00
Andrea Terzolo	e83dbe85f7	cleanup(config): modern bpf is no more experimental Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-05-12 12:27:45 +02:00
Luca Guerra	f5c7574eba	update(ci): fail on non-semver release Signed-off-by: Luca Guerra <luca@guerra.sh> Co-authored-by: Federico Di Pierro <nierro92@gmail.com>	2023-05-10 11:05:10 +02:00
Luca Guerra	b50ccd4cd1	update(ci): update needs for build docker Signed-off-by: Luca Guerra <luca@guerra.sh> Co-authored-by: Federico Di Pierro <nierro92@gmail.com>	2023-05-10 11:05:10 +02:00
Luca Guerra	fb8205a2f7	update(ci): explicit branch name in action Signed-off-by: Luca Guerra <luca@guerra.sh> Co-authored-by: Federico Di Pierro <nierro92@gmail.com>	2023-05-10 11:05:10 +02:00
Luca Guerra	369f733a36	update(docs): clarify release checking in the readme Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-10 11:05:10 +02:00
Luca Guerra	7e5a578c89	update(readme): add pre-release instructions to RELEASE.md Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-10 11:05:10 +02:00
Luca Guerra	564eed2dee	update(ci): move version computation logic to main jobs master/release Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-10 11:05:10 +02:00
Luca Guerra	24693a1e1e	update(ci): move release outputs declaration Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-10 11:05:10 +02:00
Luca Guerra	33b0173657	update(ci): react to release publishing, rewire variables Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-10 11:05:10 +02:00
Luca Guerra	d4fa8d6d91	new(ci): add RC/prerelease support Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-10 11:05:10 +02:00
jabdr	f25c057ce8	Remove MAKEWRAPPER var Signed-off-by: jabdr <jd@q321.de>	2023-05-04 13:14:32 +02:00
jabdr	e1492ae9df	Use TMPDIR for falco-driver-loader Signed-off-by: jabdr <jd@q321.de>	2023-05-04 13:14:32 +02:00
jabdr	b83b1e2578	falco-driver-loader add TMPDIR support Closes 2517 Make wrapper now uses $TMPDIR if set. Signed-off-by: jabdr <jd@q321.de>	2023-05-04 13:14:32 +02:00
dependabot[bot]	c18d545259	build(deps): Bump submodules/falcosecurity-rules Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `1bd7e4a` to `f773578`. - [Release notes](https://github.com/falcosecurity/rules/releases) - [Commits](`1bd7e4ac3a...f7735788b1`) --- updated-dependencies: - dependency-name: submodules/falcosecurity-rules dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2023-05-04 10:01:30 +02:00
Luca Guerra	b47ea18736	fix(ci): configure ECR public region Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-04 09:48:32 +02:00
Luca Guerra	253100ab75	fix(ci): falco images directory, ecr login Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-03 18:26:27 +02:00
Luca Guerra	293d4c51f1	fix(ci): separate rpm/bin/bin-static/deb packages before publication, rename bin-static Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-03 15:22:27 +02:00
dependabot[bot]	f006f2e01a	build(deps): Bump submodules/falcosecurity-rules Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `3f52480` to `1bd7e4a`. - [Release notes](https://github.com/falcosecurity/rules/releases) - [Commits](`3f52480618...1bd7e4ac3a`) --- updated-dependencies: - dependency-name: submodules/falcosecurity-rules dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2023-05-03 11:56:27 +02:00
Luca Guerra	5237aa196c	fix(ci): add Cloudfront Distribution ID Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-02 14:25:07 +02:00
Luca Guerra	4e25367350	fix(ci): escape heredoc Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-05-02 09:47:30 +02:00
Federico Di Pierro	593404e79e	chore(ci): build-musl-package does not need to wait for build-packages anymore. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-28 14:53:17 +02:00
Luca Guerra	6650a4f31f	fix(ci): only add the secret key to env when necessary Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-04-28 13:21:17 +02:00
Luca Guerra	d1e6452ad7	fix(ci): download artifacts one by one Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-04-28 13:21:17 +02:00
Luca Guerra	6d0aff7463	fix(ci): update fetch-version steps Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-04-28 13:21:17 +02:00
Federico Di Pierro	a193a46981	chore(ci): properly document new reusable_build_packages step. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Luca Guerra <luca@guerra.sh>	2023-04-28 10:14:16 +02:00
Federico Di Pierro	f448023a8f	fix(ci): properly fetch Falco version in a single step, then force-use it in subsequent steps, in reusable build packages. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-28 10:14:16 +02:00
Federico Di Pierro	c225819186	chore(ci): build recent git from source in centos7 reusable build packages workflow. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-28 10:14:16 +02:00
Federico Di Pierro	a5efbc9483	fix(ci): try to fix Falco version. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-28 10:14:16 +02:00
Federico Di Pierro	ad75c87e21	chore(ci): properly install recent version of git (needed >= 2.18 by checkout action) to fix Falco versioning. Moreover, fixed path to output packages from Falco `make package` target. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 20:14:15 +02:00
Luca Guerra	fb105c4b04	fix(ci): enable toolset before every make command Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-04-27 16:32:14 +02:00
Luca Guerra	fe8899c90a	fix(ci): remove unnecessary mv Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-04-27 15:47:14 +02:00
Luca Guerra	2de8c06bb1	fix(ci): bucket -> bucket_suffix Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-04-27 15:03:14 +02:00
Federico Di Pierro	86d33ae5ab	chore(ci): improved GPG_KEY management through an env. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Luca Guerra <luca@guerra.sh>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	9d6a7d8ca3	chore(ci): use Noelware/docker-manifest-action pinned version to latest tag. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Luca Guerra <luca@guerra.sh>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	d27828a0d2	chore(ci): added some comments. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Luca Guerra <luca@guerra.sh>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	89f29e6d4b	chore(ci): renamed `bucket` to `bucket_suffix`. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Luca Guerra <luca@guerra.sh>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	2a22189222	chore(ci): added AWS ECR login to reusable_publish_docker. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Luca Guerra <luca@guerra.sh>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	a5620b81b2	chore(ci): `reusable_public_packages` needs proper permissions. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	b9c0ca3abe	chore(ci): avoid publishing images in `reusable_build_docker.yaml` workflow. Instead, store image tarballs as artifact and download them in `reusable_publish_docker.yaml` workflow, to be finally merged in multi-arch images and pushed. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	008d908ee0	cleanup(ci): dropped test jobs in CI.yml. Some small fixes in other workflows. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	2f11d9f506	chore(ci): install awscli in reusable_build_docker workflow. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	60d8c49772	fix(ci): do not use `inputs.tagname`. Instead, rely on `github.ref_name`. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	3693cd0685	chore(ci): test reusable_build_docker from PR CI. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	31da4b4c3d	chore(ci): run reusable_build_docker workflow without any container. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	9551e9f277	chore(ci): added aws credentials role to the reusable_publish_packages workflow. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	2af7fd9f0f	fix(ci): fixed reusable_build_packages to properly install `git` before invoking checkout action, to download full repo. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	1c3aa7a83b	chore(ci): multiple fixes to new master and release ci jobs. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	18372323d9	cleanup(ci): dropped test arm64 job from pull_request CI, since it is now working. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	be13ee044e	chore(ci): fixed up master and release yamls. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	ac4e27ccde	update(ci): add an arm test CI job. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	d5b72f89f0	chore(ci): commented out circleCI master and release jobs. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	cafb804c11	chore(ci): disable on push: master trigger for ci.yml. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	6bf6a34a59	chore(ci): add proper concurrency groups for master and release CI. Renamed `dev.yaml` to `master.yaml`. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	b138e4c9e1	new(ci): added github action workflows for dev and release CI (packages + docker images publish). Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 14:25:14 +02:00
Federico Di Pierro	53c9f3a743	fix(scripts): fix falco-driver-loader for some debian kernels. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-27 11:46:14 +02:00
Jason Dellaluce	1f4919bfe1	update: improve control and UX of ignored events Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-27 11:10:14 +02:00
Jason Dellaluce	4d24a02ad6	fix(userspace/falco): preserve config's plugin loading order Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-26 12:59:13 +02:00
Jason Dellaluce	8926022035	update: adapt Falco to new sinsp event source management Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-26 12:59:13 +02:00
Jason Dellaluce	95fa953398	update(cmake): bump libs and driver to ffcd702cf22e99d4d999c278be0cc3d713c6375c Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-26 12:59:13 +02:00
Federico Di Pierro	0d73f9624d	update(scripts): updated falco-driver-loader to support al2022 and al2023. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-14 20:00:08 +02:00
dependabot[bot]	0f1f413221	build(deps): Bump submodules/falcosecurity-rules Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `5857874` to `1bd7e4a`. - [Release notes](https://github.com/falcosecurity/rules/releases) - [Commits](`5857874e95...1bd7e4ac3a`) --- updated-dependencies: - dependency-name: submodules/falcosecurity-rules dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2023-04-11 10:30:16 +02:00
dependabot[bot]	a77a58b2a9	build(deps): Bump submodules/falcosecurity-rules Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `694adf5` to `5857874`. - [Release notes](https://github.com/falcosecurity/rules/releases) - [Commits](`694adf59e0...5857874e95`) --- updated-dependencies: - dependency-name: submodules/falcosecurity-rules dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2023-04-06 12:51:56 +02:00
Jason Dellaluce	91cca0bd0e	update(cmake): bump libs and drivers to 5b4dd9e2ae0cd2efeaf9da37d8c29631241d448c9ce5b0e35d8dd7f81d814034 Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-04 19:39:53 +02:00
Jason Dellaluce	06d36d6e1b	test(userspace/falco): leverage new sc_set_to_event_names API and solve last few todos Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-04 19:39:53 +02:00
Jason Dellaluce	3b64052832	update(userspace/falco): leverage new sc_set_to_event_names API Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-04 19:39:53 +02:00
Leonardo Grasso	88b9537618	chore(userspace/falco): remove Mesos support Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2023-04-04 18:31:52 +02:00
Leonardo Grasso	5c0cd6a170	update!: remove `--mesos-api`,`-pmesos`, and `-pm` command-line flags Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2023-04-04 18:31:52 +02:00
Melissa Kilby	306d76d06b	cleanup(unit_tests): try making test_configure_interesting_sets more robust Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-04-04 17:55:52 +02:00
Federico Di Pierro	597f07ccae	update(ci): only set concurrency group for PRs. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>	2023-04-04 17:09:53 +02:00
Federico Di Pierro	de23899e49	cleanup(ci): properly set a concurrency for CI workflows. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-04-04 17:09:53 +02:00