Update Falco libs - #76
Merged
Merged
Conversation
dcarolloz
commented
Apr 24, 2026
dcarolloz
commented
Contributor
- Updated Falco libs to v0.23.2
- Updated Falco driver to v9.1.0
- Update Falcoctl to v0.12.2
- Replaced sha1 for FOID generation from OpenSSL to hash-library as OpenSSL was dropped from Falco libs
- Removed deps not anymore in Falco libs
- Disabled container functionalities as not available anymore out of the box in Falco libs (requires plugin but the go based plugin clashes with muslc)
- Added container filtering
- Update falco driver, libs modules - Integrate sha1 from hash-library as replacement of openSSL - Fix user/group fetching and filter out containerized processes - Disable container functionalities not available anymore OOTB from Falco - Adjust falco lib calls Signed-off-by: Daniele Carollo <carollo.dani@gmail.com>
Signed-off-by: Daniele Carollo <carollo.dani@gmail.com>
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
…23.2" This reverts commit f08e5f3. Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
araujof
self-requested a review
July 30, 2026 05:18
araujof
approved these changes
Jul 30, 2026
araujof
left a comment
araujof
left a comment
Member
There was a problem hiding this comment.
LGTM
Fixed lint/format issues.
A few comments:
- The -c filter inversion + suppress_events_tid in sysflowprocessor.cpp (documented meaning of -c flipped).
- get_parent_thread() → get_ancestor_process() changing process-lineage semantics.
The alpine CI build fails because this is a fork and the fork doesn't have access to the CI secrets to log to image registry. I tested it locally and it works. Once it merges, it should be build fine in dev.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.