What happened in Falco this week? For reals, this is the LAST one ;)

First of all, congrats to the whole community, it's been an incredibly rocking year, and I am looking forward to the next challenges. So, back to the topic, what happened?

Libs has seen lots of effort, after the tags and the subsequent master branch thaw.

• No, it is a serious, tremendous effort: in this week, we merged 100+ commits 
• Thanks to the big work being carried on by @dub, we added support for multiple syscalls in the modern bpf probe. The missing ones count is now ~35!! https://github.com/falcosecurity/libs/pull/752, https://github.com/falcosecurity/libs/pull/778, https://github.com/falcosecurity/libs/pull/801
• modern bpf tests are being ported to other drivers; the work is going on smoothly: https://github.com/falcosecurity/libs/pull/798, https://github.com/falcosecurity/libs/pull/808, https://github.com/falcosecurity/libs/pull/812
• a new big refactor happened in libscap: https://github.com/falcosecurity/libs/pull/787
• fixes for number of drops in the modern bpf probe: https://github.com/falcosecurity/libs/pull/802
• fixes for podman: https://github.com/falcosecurity/libs/pull/763
• fixes for cri: https://github.com/falcosecurity/libs/pull/771
• libsinsp does now allow to enable/disable individual container engines: https://github.com/falcosecurity/libs/pull/772
• using namespace std in headers NO MORE! https://github.com/falcosecurity/libs/pull/769
• enhancements to initial scan of proc: https://github.com/falcosecurity/libs/pull/767
• Remember that all of the above won't be part of next Falco release :wink: aside from https://github.com/falcosecurity/libs/pull/802.

Falco saw a couple of PRs too:

• BottleRocketOS support in falco-driver-loader: https://github.com/falcosecurity/falco/pull/2318
• Modern probe support!!! https://github.com/falcosecurity/falco/pull/2320 Basically, this means that new Falco images will internally ship the modern bpf probe ready to be used where supported! :modernbpf: :rocket:

Falcoctl is still seeing loads of improvements!

• added a new artifact subcmd: https://github.com/falcosecurity/falcoctl/pull/181
• implemented oauth2 authentication: https://github.com/falcosecurity/falcoctl/pull/177
• internal refactors: https://github.com/falcosecurity/falcoctl/pull/195, https://github.com/falcosecurity/falcoctl/pull/196, https://github.com/falcosecurity/falcoctl/pull/197, https://github.com/falcosecurity/falcoctl/pull/198, https://github.com/falcosecurity/falcoctl/pull/199
• Test-infra has seen the starting point to support native arm64 driver builds!!
• docker-dind and build-drivers images are now pushed multiplatform! https://github.com/falcosecurity/test-infra/pull/934, https://github.com/falcosecurity/test-infra/pull/933

Driverkit gained support for BottleRocketOS and saw a new release: https://github.com/falcosecurity/driverkit/releases/tag/v0.11.0

• kernel-crawler gained support for BottlerRocketOS and saw a new release: https://github.com/falcosecurity/kernel-crawler/releases/tag/0.5.0

And yes, next Falco release will support BottleRocketOS prebuilt drivers :wink:
Next year we will resume our work starting from:

• new syscalls for modern bpf! https://github.com/falcosecurity/libs/pull/776, https://github.com/falcosecurity/libs/pull/800, https://github.com/falcosecurity/libs/pull/797, https://github.com/falcosecurity/libs/pull/806
• fixes for old bpf probe on s390x platform: https://github.com/falcosecurity/libs/pull/809, https://github.com/falcosecurity/libs/pull/811
• end of porting modern-bpf test framework to all drivers
• drivers cleanups: https://github.com/falcosecurity/libs/pull/759
• improved curl resiliency in falco-driver-loader: https://github.com/falcosecurity/falco/pull/2336

test-infra arm64 drivers jobs ported to natively build on arm64 nodes :wink:

• possibly improved driverkit builder images selection: https://github.com/falcosecurity/driverkit/issues/241

So...that's all folks!

Have a sweet xmas time with your family, and have a great start for the next year!
See you in 2023