Download

Officially supported Falco artifacts

Falco and its ecosystem components are available as downloadable files and OCI (Open Container Initiative) artifacts. This page provides the official URLs for accessing these artifacts.

For a comprehensive overview of the available artifacts and their versioning, refer to the Falco release documentation.

Packages

For installation instructions, refer to the Install on a host (DEB, RPM) or the Install on a host (tarball) pages.

The tables below provide quick links for Falco packages hosted at download.falco.org.

PackagesDownload for Linux x86_64
rpmrpm
debdeb
binarytgz
PackagesDownload for Linux aarch64
rpmrpm
debdeb
binarytgz

Container images

For deployment instructions, refer to the Deploy as a container or the Deploy on Kubernetes pages.

The tables below provide quick pull commands for Falco container images hosted at Docker Hub.

tagpull commanddescription
latestdocker pull falcosecurity/falco-no-driver:latestThe most recent version
versiondocker pull falcosecurity/falco-no-driver:<version>A specific version of Falco such as 0.39.1
latestdocker pull falcosecurity/falco-driver-loader:latestThe most recent version of falco-driver-loader with the building toolchain
versiondocker pull falcosecurity/falco-driver-loader:<version>A specific version of falco-driver-loader such as 0.39.1 with the building toolchain
latestdocker pull falcosecurity/falco:latestThe most recent version with the falcoctl driver tool included
versiondocker pull falcosecurity/falco:<version>A specific version of Falco such as 0.39.1 with falcoctl driver tool included

Rules

The Falco packages and container images come with a built-in ruleset file (including only rules with maturity stable level). Those rules and others with different maturity levels are available as downloadable files at download.falco.org and are also available as OCI artifacts (refer to falcoctl documentation for downloading and installing OCI artifacts).

Plugins

Plugins hosted by The Falco Project are available as downloadable packages at download.falco.org and are also available as OCI artifacts (refer to falcoctl documentation for downloading and installing OCI artifacts).

Drivers

When using Falco for Kernel Events (i.e., with the syscall data source enabled), the Falco binary relies on having a driver available on the host system.

Starting from Falco 0.38.0, the default driver is the Modern eBPF driver, which is included in the Falco binary and built using the CO-RE "Compile Once - Run Everywhere" technology. If your system satisfies the modern eBPF driver requirements, no further action is needed. Otherwise, you need to use the eBPF probe or the Kernel Module, which provide wider compatibility.

In brief, you don't need to install a driver if you are either:

Pre-built Falco drivers for a vast variety of Linux Kernel releases are distributed at download.falco.org.

To download a pre-built driver, navigate to the driver versions' directory that is compatible with the Falco binary you're currently using (check with falco --version), then download the kernel artifact corresponding to your kernel release (uname -r) for either .ko (kernel module) or .o (legacy eBPF driver). To make this easier, Falco comes with the falcoctl tool that automates the driver download (or tries to build it on the fly). The Install guide will explain this more, and the text blob below also has more information.

Tools

Falcoctl

falcoctl is a command-line tool that helps you manage Falco and its ecosystem components. It is included in the Falco distribution and can be used to download and install Falco drivers, rules, plugins, and other artifacts.

You can also manually download falcoctl from GitHub releases.

Helm Charts

For deployment instructions using Helm, please refer to the Deploy on Kubernetes page.

The Falco Project provides various Helm charts and documentation for Falco and its ecosystem tools.

For detailed information about these charts, refer to the Falco Helm Charts repository.

For information about how to download and install Helm, see the official Helm installation guide.

View Installing Helm Guide