Introducing Falco 0.38.1

Today we announce the release of Falco 0.38.1 🦅!

Fixes

Falco's 0.38.1 is a patch release aimed at addressing a few important bugs. It includes the following fixes:

• A Falco crash while running with plugins and metrics enabled has been solved (https://github.com/falcosecurity/falco/issues/3229)
• Falco -p output format option can now be passed to plugin events while -pc and -pk can only be used for syscall sources. Fixes an issue that could result in Falco exiting with LOAD_ERR_COMPILE_OUTPUT on startup with k8s clusters that had -pk and audit enabled (https://github.com/falcosecurity/falco/pull/3239)
• Fixed an issue that could prevent the integer compare operators <, <=, >, >= in rules from working properly (https://github.com/falcosecurity/falco/issues/3245)
• Ignore NSS user and group entries while loading users and groups (https://github.com/falcosecurity/libs/pull/1909)
• Issues related to the new metric-related plugins API (https://github.com/falcosecurity/libs/pull/1885). Plugin API was also bumped to 3.6.0.
• Plugin metrics are now enabled in Falco (https://github.com/falcosecurity/falco/pull/3228). Note that plugin must make use of the new metrics-related API to expose metrics.
• Libs were updated to 0.17.2

Thanks to everyone in the community for helping us in spotting these annoying bugs 🐛! You make Falco successful 🦅!

Thanks as always to the Falco maintainers for their support and effort during the entire release process.

Try it! 🏎️

As usual, in case you just want to try out the stable Falco 0.38.1, you can install its packages following the process outlined in the docs:

• CentOS/Amazon Linux
• Debian/Ubuntu
• openSUSE
• Linux binary package

Prefer to use a container image? No problem at all! 🐳

You can read more about running Falco with Docker in the docs.

You can also find the Falcosecurity container images on the public AWS ECR gallery:

• falco
• falco-no-driver
• falco-driver-loader

Let's meet 🤝

We meet every Wednesday in our community calls, if you want to know the latest and the greatest you should join us there!

If you have any questions

• Join the #falco channel on the Kubernetes Slack
• Join the Falco mailing list

Thanks to all the amazing contributors!

Cheers 🎊

Federico

• ←Previous
Next→