LoginSign Up
← Back to all sparks
F

Falco

INFRA · APIS
Velocity0.0

Cloud native runtime security and threat detection

falco.org ↗

Falco's 0.45 cycle adds a reload API for operators, then goes quiet.

runtime-securitykubernetescloud-nativeopen-sourceoperators
◆Current state
Falco cut four 0.45.0 release candidates in September, then 0.45.1-rc1 on October 5 with an updated container plugin. The one user-facing feature in the cycle is in rc4: Falco can report its reload status and readiness, and accept reload requests over a locked-down Unix socket. The other candidates bump the underlying libraries, the engine version and the bundled falcoctl tool.
◆Where it's heading
The reload API is built for the Falco Operator, which points to Falco being run and reconfigured by Kubernetes automation rather than by hand. Releases are infrequent and arrive as release candidates in the feed, so most visible work is plumbing between Falco, its libraries and its tooling.
◆Prediction
A 0.45.1 final with the container plugin fix is the obvious next entry; what 0.46 will bring is not visible in these notes.

◆Recent moves

  1. 1mo ago

    Falco 0.45.1 RC1 updates the container plugin

    A one-line release candidate that bumps the container plugin in the Helm chart. Maintenance after the 0.45 cycle.

    View source ↗
  2. 1mo ago

    Falco 0.45 RC4 adds reload status and Unix socket reload control

    Falco now reports readiness and reload outcomes over HTTP and accepts reload requests through an opt-in, permission-checked Unix socket. It is the feature the Falco Operator needs to reconfigure Falco safely, and the main user-facing change of 0.45.

    View source ↗
  3. 2mo ago

    Falco 0.45 RC3 bundles falcoctl 0.14.2

    The bundled falcoctl moves to 0.14.2, which keeps DKMS installs intact when cached kernel modules are installed. A packaging fix.

    View source ↗
  4. 2mo ago

    Falco 0.45 RC2 pins libs 0.26.0-rc2

    A version pin to the next libs release candidate with no driver changes. Internal release plumbing.

    View source ↗
  5. 2mo ago

    Falco 0.45 RC1 bumps the engine to 0.65.0

    The first 0.45 candidate bumps the rules engine version because the driver schema changed. No user-facing behavior is described.

    View source ↗
  6. 5mo ago

    Falco 0.44.1 RC1 lets users turn off BPF iterators

    A new option to disable BPF iterators, useful on kernels where they misbehave. A small but real control for operators.

    View source ↗