Download
Falco and its ecosystem components are available as downloadable files and OCI (Open Container Initiative) artifacts. This page provides the official URLs for accessing these artifacts.
For a comprehensive overview of the available artifacts and their versioning, refer to the Falco release documentation.
Packages
For installation instructions, refer to the Install on a host (DEB, RPM) or the Install on a host (tarball) pages.
The tables below provide quick links for Falco packages hosted at download.falco.org.
| Packages | Download for Linux x86_64 |
|---|---|
| rpm |  |
| deb |  |
| binary |  |
| Packages | Download for Linux aarch64 |
|---|---|
| rpm |  |
| deb |  |
| binary |  |
Container images
For deployment instructions, refer to the Deploy as a container or the Deploy on Kubernetes pages.
The tables below provide quick pull commands for Falco container images hosted at Docker Hub.
| tag | pull command | description |
|---|---|---|
| latest | docker pull falcosecurity/falco-no-driver:latest | The most recent version |
| version | docker pull falcosecurity/falco-no-driver:<version> | A specific version of Falco such as 0.39.1 |
| latest | docker pull falcosecurity/falco-driver-loader:latest | The most recent version of falco-driver-loader with the building toolchain |
| version | docker pull falcosecurity/falco-driver-loader:<version> | A specific version of falco-driver-loader such as 0.39.1 with the building toolchain |
| latest | docker pull falcosecurity/falco:latest | The most recent version with the falcoctl driver tool included |
| version | docker pull falcosecurity/falco:<version> | A specific version of Falco such as 0.39.1 with falcoctl driver tool included |
Rules
The Falco packages and container images come with a built-in ruleset file (including only rules with maturity stable level). Those rules and others with different maturity levels are available as downloadable files at download.falco.org and are also available as OCI artifacts (refer to falcoctl documentation for downloading and installing OCI artifacts).
Plugins
Plugins hosted by The Falco Project are available as downloadable packages at download.falco.org and are also available as OCI artifacts (refer to falcoctl documentation for downloading and installing OCI artifacts).
Drivers
When using Falco for Kernel Events (i.e., with the syscall data source enabled), the Falco binary relies on having a driver available on the host system.
Starting from Falco 0.38.0, the default driver is the Modern eBPF driver, which is included in the Falco binary and built using the CO-RE "Compile Once - Run Everywhere" technology. If your system satisfies the modern eBPF driver requirements, no further action is needed. Otherwise, you need to use the eBPF probe or the Kernel Module, which provide wider compatibility.
In brief, you don't need to install a driver if you are either:
- using the modern eBPF driver (default option)
- or if you are using only plugin data sources.
Pre-built Falco drivers for a vast variety of Linux Kernel releases are distributed at download.falco.org.
To download a pre-built driver, navigate to the driver versions' directory that is compatible with the Falco binary you're currently using (check with falco --version), then download the kernel artifact corresponding to your kernel release (uname -r) for either .ko (kernel module) or .o (legacy eBPF driver). To make this easier, Falco comes with the falcoctl tool that automates the driver download (or tries to build it on the fly). The Install guide will explain this more, and the text blob below also has more information.
Tools
Falcoctl
falcoctl is a command-line tool that helps you manage Falco and its ecosystem components. It is included in the Falco distribution and can be used to download and install Falco drivers, rules, plugins, and other artifacts.
You can also manually download falcoctl from GitHub releases.
Helm Charts
For deployment instructions using Helm, please refer to the Deploy on Kubernetes page.
The Falco Project provides various Helm charts and documentation for Falco and its ecosystem tools.
For detailed information about these charts, refer to the Falco Helm Charts repository.
For information about how to download and install Helm, see the official Helm installation guide.
Was this page helpful?
Let us know! You feedback will help us to improve the content and to stay in touch with our users.
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.
