[TRACKING] Breaking changes in Falco 0.38

[Andreagit97]

This issue keeps track of all deprecated Falco features that will be removed in Falco 0.38

• [ ] Modern probe docker builder: https://github.com/falcosecurity/falco/tree/master/docker/builder, it is no more used
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3088
• [ ] syscall_buf_size_preset falco config in favor of engine.kmod/ebpf/modern_ebpf.buf_size_preset
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] syscall_drop_failed_exit falco config in favor of engine.kmod/ebpf/modern_ebpf.drop_failed_exit
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] modern_bpf.cpus_for_each_syscall_buffer falco config in favor of engine.modern_ebpf.cpus_for_each_buffer
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] FALCO_BPF_PROBE env var in favor of engine.ebpf.probe
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] -e command line flag in favor of engine.replay.capture_file
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] g,gvisor-config command line flag in favor of engine.gvisor.config
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] gvisor-root command line flag in favor of engine.gvisor.root
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] modern-bpf command line flag in favor of engine.kind=modern_ebpf
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] nodriver command line flag in favor of engine.kind=nodriver
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2413/files
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087
• [ ] syscall_event_drops falco config will be replaced by the metrics config plus some automatic notification on drops
  • deprecation PR: https://github.com/falcosecurity/falco/pull/3015
  • breaking change PR: https://github.com/falcosecurity/falco/pull/3087

[leogr]

/assign @Andreagit97

[FedeDP]

Non-breaking change, still worth noting: https://github.com/falcosecurity/falco/pull/3162

[Andreagit97]

This https://github.com/falcosecurity/rules/pull/244 is not a breaking change but is important for our users to know that the correct notation is <NA> if they run live capture. In the case of old scap-files is possible that some N/A will be sent