Falco 0.44 removes legacy engines and hardens runtime detection

Falco released version 0.44.0 on May 26, completing a deprecation cycle that removes the legacy eBPF probe, gVisor engine, and gRPC output and server. The official release post also details new rule operators, stricter schema validation, bounded capture files, faster process-tree lookup, and security hardening.

Cleaner internals come with upgrade work

The driver API and schema received a major bump, and the project warns that 0.43 userspace and drivers are not compatible with 0.44. Operators must redeploy matching drivers rather than assuming a rolling userspace change is enough. Environments still consuming gRPC output also need a replacement path before the old server disappears.

Several changes reduce silent failure. Unknown top-level keys in rules now cause validation errors instead of being ignored, which turns a misspelled field into a visible deployment problem. A new capture-size ceiling can prevent incident recordings from filling disks, while JSON output for listing commands makes rule and field inventories easier to automate.

Test detections, not only daemon health

The release includes rule updates and new runtime coverage, including keyctl syscall support and supply-chain-oriented detections. A staging plan should compile every custom rule under the stricter schema, deploy matching drivers, and fire representative events.

One failure case deserves special attention: a DaemonSet can remain ready while an incompatible driver or removed output leaves the security pipeline ineffective. Acceptance should require a synthetic detection to arrive at the downstream alert sink with expected fields.

Falco 0.44 is a deliberate cleanup release with useful operational safeguards. Its breaking changes are manageable when driver, rule, capture, and delivery paths are tested as one runtime-detection system.