Mark Stemm 2d5fc0b647 Use the same falco_rule struct for every call to filter_ruleset ...

Instead of using a falco_rule struct on the stack, use a single value
inside the falco_source struct. It's mutable as find_source returns a
const struct.

At very high event volumes (> 1M syscalls/second), even the tiny time
it takes to create/destroy the struct starts to add up, and this
switch has some small cpu savings.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

2022-09-16 12:50:39 +02:00

..

engine

Use the same falco_rule struct for every call to filter_ruleset

2022-09-16 12:50:39 +02:00

falco

update(userspace/falco): gVisor sock now defaults to /run/falco/gvisor.sock

2022-09-14 10:27:24 +02:00