A Decade of Detection: Falco’s Architecture and How It Works

▶ Watch (1:36)

Falco open-sourced in 2016, donated to the CNCF in 2018, and graduated in 2024 at the highest maturity level. The engine works by instrumenting the kernel via eBPF or a kernel module. Those probes generate syscall events sent to a user-space detection engine, where YAML-based rules match against the event stream and produce alerts. A plugin system lets users add custom event sources or enrich built-in events with metadata from container runtimes or Kubernetes.

Falco 0.42 and 0.43: Forensics and a 20% Latency Cut

▶ Watch (4:08)

Falco 0.42 (October 2025) added capture recording. Rules can now carry a capture flag that triggers a scap file of configurable duration when they fire. That file loads into Sysdig’s Sysdig’s Stratark, a sibling tool to Wireshark authored by Gerald Combs, Wireshark’s original author. Falco 0.43 (early 2026) completed the drop-enter initiative, consolidating enter and exit syscall events into a single exit event. Benchmarks showed a 20% latency reduction in instrumented programs and lower CPU consumption in the Falco process itself.

Falco Operator 0.2: Production-Ready Kubernetes Management

▶ Watch (7:38)

Helm deploys Falco but stops watching after the chart lands. The Falco Operator closes that gap by keeping the cluster state reconciled toward a declared spec. Version 0.2 is the first release called production-ready, and it will become the default way to run Falco on Kubernetes going forward. The architecture splits into two components: an artifact operator injected as a sidecar into every Falco pod (sharing files via emptyDir volumes), and a top-level Falco operator that users interact with through the falco.security.dev API group. Version 0.2 adds structured YAML validation in CRs, ConfigMap support for rules files, self-hosted OCI registry TLS configuration, and component management for Falco Sidekick, the Sidekick UI, and the meta-collector.

What’s Next: BPF Iterators and Multi-Threading

▶ Watch (16:38)

Falco currently scans /proc by opening, reading, and closing many small files during initialization and state recovery. That scan generates noise through the Falco engine itself. BPF iterators, available since Linux 5.8, traverse kernel task and file structures directly without touching /proc. The implementation by Leonardo de Javana is already merged to master and ships in 0.44. Separately, the single-threaded event loop strains machines with many cores. An experimental multi-threaded version, partitioning events by thread group ID to minimize cross-partition locking, will appear in the next release as a base to iterate on.

Developer Experience: LSP Extension and an AI Guardrail Plugin

▶ Watch (22:14)

A new VS Code extension (by Alessandro Canela) adds code completion and syntax highlighting for Falco rules. The underlying language server is generic, so other editors can adopt it. A separate tech-preview plugin turns Falco into a guardrail for AI coding agents. The plugin hooks into Claude Code, intercepts commands before execution, runs them through the Falco engine, and returns accept, reject, or confirmation-required decisions. It installs on macOS, Windows, and Linux. Current support covers Claude Code only, but the project is collecting feedback for broader agent support.

Community Funding: $70k in Contributor Grants

▶ Watch (25:33)

Sysdig donated $70k to the CNCF to mark Falco’s tenth anniversary. The money funds three programs: development grants for contributors accelerating new capabilities, stipends for recognized high-level contributors, and stipends for technical writers keeping documentation current. Community calls run every two weeks on Wednesdays, and the project is reachable on Slack.

Notable Quotes

the some uh benchmarks revealed like a 20% latency reduction in the instrumented uh programs Iacopo Rozzo · ▶ 06:37

with the 0.2 two version. Uh this is the first release that we feel confident to call it uh production ready Aldo Lacuku · ▶ 08:56

going forward uh the fal operator will be the default way on uh running Falcon on Kubernetes. Aldo Lacuku · ▶ 09:06

we basically uh experimented with Falco and we turned Falco into uh a um basically uh uh guardrail layer for uh AI uh engines. Iacopo Rozzo · ▶ 24:01

sysdig to celebrate the 10 years anniversary donated uh 70k to the CNCF Iacopo Rozzo · ▶ 25:53

Key Takeaways

  • The drop-enter initiative cut instrumented program latency by 20% in Falco 0.43.
  • Falco Operator 0.2 is production-ready and replaces Helm as the default Kubernetes deployment path.
  • BPF iterators replace slow /proc scanning and land in Falco 0.44, already merged to master.

About the Speaker(s)

Iacopo Rozzo is a Staff Open Source Engineer at Sysdig focused on system programming and cloud-native runtime security. He contributes actively to Falco and has merged work into Kubernetes and Envoy as well.

Aldo Lacuku is a Senior Software Engineer at Kong Inc. specializing in Kubernetes and cloud-native technologies, with a focus on API Gateway delivery inside Kubernetes. He also contributes to the Falco project.