chore!: drop legacy BPF probe by ekoops · Pull Request #2829 · falcosecurity/libs

ekoops · 2026-02-06T09:50:45Z

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

/kind sync

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

Falco 0.43.0 deprecated the legacy eBPF probe as approved in https://github.com/falcosecurity/falco/blob/0.43.0/proposals/20251215-legacy-bpf-grpc-output-gvisor-engine-deprecation.md, and the support will be removed soon in the next libs release. This PR drops any reference to it and any CI tests testing it.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

/milestone 0.24.0

Does this PR introduce a user-facing change?:

chore!: drop legacy BPF probe

github-actions · 2026-02-06T09:51:02Z

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

github-actions · 2026-02-06T09:53:57Z

Perf diff from master - unit tests

    13.49%     -3.62%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_add_ref_lock_nothrow()
    10.84%     +3.07%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::_M_get_use_count() const
     3.98%     +0.85%  [.] thread_group_info::get_first_thread() const
     9.73%     -0.49%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release()
     4.14%     -0.37%  [.] sinsp_thread_manager::create_thread_dependencies(std::shared_ptr<sinsp_threadinfo> const&)
     6.61%     +0.31%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count(std::__weak_count<(__gnu_cxx::_Lock_policy)2> const&, std::nothrow_t)
    15.36%     +0.17%  [.] std::__shared_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2>::__shared_ptr(std::__weak_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2> const&, std::nothrow_t)
     8.20%     -0.14%  [.] sinsp_threadinfo::get_fd_table()
     0.27%     -0.12%  [.] scap_event_encode_params_v
     0.16%     -0.11%  [.] (anonymous namespace)::plugin_parse_event(void*, ss_plugin_event_input const*, ss_plugin_event_parse_input const*)

Heap diff from master - unit tests

peak heap memory consumption: 97B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 80B

Heap diff from master - scap file

peak heap memory consumption: 81B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0296         -0.0297           240           233           239           232
BM_sinsp_split_median                                          -0.0297         -0.0292           240           233           240           233
BM_sinsp_split_stddev                                          -0.7142         -0.7141             5             1             5             1
BM_sinsp_split_cv                                              -0.7055         -0.7053             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0355         -0.0356            70            68            70            68
BM_sinsp_concatenate_paths_relative_path_median                -0.0373         -0.0373            70            68            70            68
BM_sinsp_concatenate_paths_relative_path_stddev               +12.1098        +11.9120             0             1             0             1
BM_sinsp_concatenate_paths_relative_path_cv                   +12.5923        +12.3893             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     +0.0591         +0.0593            41            43            41            43
BM_sinsp_concatenate_paths_empty_path_median                   +0.0879         +0.0881            40            44            40            44
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.8743         -0.8753             1             0             1             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.8813         -0.8823             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0092         +0.0094            69            69            69            69
BM_sinsp_concatenate_paths_absolute_path_median                +0.0092         +0.0094            69            70            69            70
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.2116         -0.1984             1             1             1             1
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.2188         -0.2058             0             0             0             0

codecov · 2026-02-06T09:58:56Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.54%. Comparing base (ca51647) to head (ce55a82).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2829      +/-   ##
==========================================
+ Coverage   74.48%   74.54%   +0.05%     
==========================================
  Files         294      294              
  Lines       30558    30534      -24     
  Branches     4838     4826      -12     
==========================================
  Hits        22762    22762              
+ Misses       7796     7772      -24

Flag	Coverage Δ
libsinsp	`74.54% <ø> (+0.05%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Falco 0.43.0 deprecated the legacy eBPF probe, and the support will be removed soon in the next libs release. Drop any reference to it and any CI tests testing it. BREAKING CHANGE: drop all code related to legacy BPF probe Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

Andreagit97

I didn’t think I’d live long enough to see this 😆
/approve x10

ekoops · 2026-02-06T16:45:07Z

I didn’t think I’d live long enough to see this 😆 /approve x10

I did it for you! 😂

Molter73 · 2026-02-06T17:06:00Z

test/drivers/README.md

 ## Rationale

-This test suite should allow you to check the behavior of our 3 drivers: `modern_bpf`, `bpf`, `kernel module`. To assert against the output of our drivers we use the so-called `scap-engines`.
+This test suite should allow you to check the behavior of our 2 drivers: `modern_bpf`, `kernel module`. To assert against the output of our drivers we use the so-called `scap-engines`.


We should probably consider renaming the modern_bpf driver to bpf now that it is the only one (not as part of this PR obviously, this one is already big enough).

Agree. Not sure we should include it in the upcoming release. I would keep it as is for the moment, and move to just "ebpf" in the next release.

deepskyblue86

/approve

poiana · 2026-02-06T17:23:50Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, deepskyblue86, ekoops

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,deepskyblue86,ekoops]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

deepskyblue86 · 2026-02-06T17:24:38Z

-15k lines🔥

ekoops · 2026-02-06T18:00:01Z

/hold cancel

github-project-automation bot added this to Falco Roadmap Feb 6, 2026

github-project-automation bot moved this to Todo in Falco Roadmap Feb 6, 2026

poiana added release-note kind/cleanup labels Feb 6, 2026

poiana added this to the 0.24.0 milestone Feb 6, 2026

poiana added dco-signoff: yes kind/design kind/documentation Improvements or additions to documentation labels Feb 6, 2026

poiana requested review from hbrueckner and terror96 February 6, 2026 09:50

poiana added kind/test PRs increasing the test coverage without fixing any failing test approved area/build area/CI area/driver-bpf area/libscap-engine-bpf area/libscap area/libsinsp area/tests size/XXL labels Feb 6, 2026

poiana added the do-not-merge/hold label Feb 6, 2026

ekoops force-pushed the ekoops/drop-legacy-bpf branch from 36bcd78 to ce55a82 Compare February 6, 2026 15:54

Andreagit97 approved these changes Feb 6, 2026

View reviewed changes

poiana assigned Andreagit97 Feb 6, 2026

poiana added the lgtm label Feb 6, 2026

Molter73 reviewed Feb 6, 2026

View reviewed changes

deepskyblue86 approved these changes Feb 6, 2026

View reviewed changes

poiana assigned deepskyblue86 Feb 6, 2026

github-project-automation bot moved this from Todo to In progress in Falco Roadmap Feb 6, 2026

poiana removed the do-not-merge/hold label Feb 6, 2026

poiana merged commit c5ea0da into falcosecurity:master Feb 6, 2026
66 of 68 checks passed

github-project-automation bot moved this from In progress to Done in Falco Roadmap Feb 6, 2026

ekoops deleted the ekoops/drop-legacy-bpf branch February 9, 2026 08:46

ekoops mentioned this pull request Feb 9, 2026

ci: remove bpf and gvisor areas from PR template #2834

Merged

leogr mentioned this pull request Feb 12, 2026

[BUG] legacy ebpf SCHEMA VERSION doesn't follow our semver rules #1283

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore!: drop legacy BPF probe#2829

chore!: drop legacy BPF probe#2829
poiana merged 1 commit intofalcosecurity:masterfrom
ekoops:ekoops/drop-legacy-bpf

ekoops commented Feb 6, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 6, 2026

Uh oh!

github-actions bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

Andreagit97 left a comment

Uh oh!

ekoops commented Feb 6, 2026

Uh oh!

Molter73 Feb 6, 2026

Uh oh!

ekoops Feb 6, 2026

Uh oh!

deepskyblue86 left a comment

Uh oh!

poiana commented Feb 6, 2026

Uh oh!

deepskyblue86 commented Feb 6, 2026

Uh oh!

ekoops commented Feb 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

ekoops commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 6, 2026

Uh oh!

github-actions bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Perf diff from master - unit tests

Heap diff from master - unit tests

Heap diff from master - scap file

Benchmarks diff from master

Uh oh!

codecov bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Andreagit97 left a comment

Choose a reason for hiding this comment

Uh oh!

ekoops commented Feb 6, 2026

Uh oh!

Molter73 Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

ekoops Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

deepskyblue86 left a comment

Choose a reason for hiding this comment

Uh oh!

poiana commented Feb 6, 2026

Uh oh!

deepskyblue86 commented Feb 6, 2026

Uh oh!

ekoops commented Feb 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ekoops commented Feb 6, 2026 •

edited

Loading

github-actions bot commented Feb 6, 2026 •

edited

Loading

codecov bot commented Feb 6, 2026 •

edited

Loading