Introducing Falco 0.38.1 - Falco

Today we announce the release of Falco 0.38.1 🦅!

Fixes

Falco's 0.38.1 is a patch release aimed at addressing a few important bugs. It includes the following fixes:

A Falco crash while running with plugins and metrics enabled has been solved (https://github.com/falcosecurity/falco/issues/3229)
Falco -p output format option can now be passed to plugin events while -pc and -pk can only be used for syscall sources. Fixes an issue that could result in Falco exiting with LOAD_ERR_COMPILE_OUTPUT on startup with k8s clusters that had -pk and audit enabled (https://github.com/falcosecurity/falco/pull/3239)
Fixed an issue that could prevent the integer compare operators <, <=, >, >= in rules from working properly (https://github.com/falcosecurity/falco/issues/3245)
Ignore NSS user and group entries while loading users and groups (https://github.com/falcosecurity/libs/pull/1909)
Issues related to the new metric-related plugins API (https://github.com/falcosecurity/libs/pull/1885). Plugin API was also bumped to 3.6.0.
Plugin metrics are now enabled in Falco (https://github.com/falcosecurity/falco/pull/3228). Note that plugin must make use of the new metrics-related API to expose metrics.
Libs were updated to 0.17.2

Thanks to everyone in the community for helping us in spotting these annoying bugs 🐛! You make Falco successful 🦅!

Thanks as always to the Falco maintainers for their support and effort during the entire release process.

As usual, in case you just want to try out the stable Falco 0.38.1, you can install its packages following the process outlined in the docs:

Prefer to use a container image? No problem at all! 🐳

You can read more about running Falco with Docker in the docs.

You can also find the Falcosecurity container images on the public AWS ECR gallery:

We meet every Wednesday in our community calls, if you want to know the latest and the greatest you should join us there!

If you have any questions

Thanks to all the amazing contributors!

Cheers 🎊

Federico