# Falco 0.44 removes legacy engines and hardens runtime detection > Falco 0.44 drops legacy eBPF, gVisor, and gRPC paths while adding stricter rules, bounded captures, faster process lookup, and new detections. Canonical URL: https://www.devobs.io/news/news-falco-0440-runtime-security-release/ By: Elias Brooks Published: 2026-09-06T11:58:54.649Z Updated: 2026-09-06T11:58:54.649Z Event date: 2026-05-26 Section: Security Falco released version 0.44.0 on May 26, completing a deprecation cycle that removes the legacy eBPF probe, gVisor engine, and gRPC output and server. The [official release post](https://falco.org/blog/falco-0-44-0/) also details new rule operators, stricter schema validation, bounded capture files, faster process-tree lookup, and security hardening. ## Cleaner internals come with upgrade work The driver API and schema received a major bump, and the project warns that 0.43 userspace and drivers are not compatible with 0.44. Operators must redeploy matching drivers rather than assuming a rolling userspace change is enough. Environments still consuming gRPC output also need a replacement path before the old server disappears. Several changes reduce silent failure. Unknown top-level keys in rules now cause validation errors instead of being ignored, which turns a misspelled field into a visible deployment problem. A new capture-size ceiling can prevent incident recordings from filling disks, while JSON output for listing commands makes rule and field inventories easier to automate. ## Test detections, not only daemon health The release includes rule updates and new runtime coverage, including `keyctl` syscall support and supply-chain-oriented detections. A staging plan should compile every custom rule under the stricter schema, deploy matching drivers, and fire representative events. One failure case deserves special attention: a DaemonSet can remain ready while an incompatible driver or removed output leaves the security pipeline ineffective. Acceptance should require a synthetic detection to arrive at the downstream alert sink with expected fields. Falco 0.44 is a deliberate cleanup release with useful operational safeguards. Its breaking changes are manageable when driver, rule, capture, and delivery paths are tested as one runtime-detection system. ## Source references -