[TRACKING] Breaking changes in Falco 0.38

[Andreagit97]

This issue keeps track of all deprecated Falco features that will be removed in Falco 0.38

• Modern probe docker builder: https://github.com/falcosecurity/falco/tree/master/docker/builder, it is no more used
  • breaking change PR: cleanup(docker)!: remove unused builder dockerfile #3088
• syscall_buf_size_preset falco config in favor of engine.kmod/ebpf/modern_ebpf.buf_size_preset
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• syscall_drop_failed_exit falco config in favor of engine.kmod/ebpf/modern_ebpf.drop_failed_exit
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• modern_bpf.cpus_for_each_syscall_buffer falco config in favor of engine.modern_ebpf.cpus_for_each_buffer
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• FALCO_BPF_PROBE env var in favor of engine.ebpf.probe
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• -e command line flag in favor of engine.replay.capture_file
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• g,gvisor-config command line flag in favor of engine.gvisor.config
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• gvisor-root command line flag in favor of engine.gvisor.root
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• modern-bpf command line flag in favor of engine.kind=modern_ebpf
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• nodriver command line flag in favor of engine.kind=nodriver
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087
• syscall_event_drops falco config will be replaced by the metrics config plus some automatic notification on drops
  • deprecation PR: update!(config): soft deprecation of drop stats counters in syscall_event_drops #3015
  • breaking change PR: [BREAKING CHANGE]: cleanup(falco.yaml)!: remove some deprecated configs #3087

[leogr]

/assign @Andreagit97

[FedeDP]

Non-breaking change, still worth noting: #3162

[Andreagit97]

This falcosecurity/rules#244 is not a breaking change but is important for our users to know that the correct notation is <NA> if they run live capture. In the case of old scap-files is possible that some N/A will be sent