[TRACKING] Breaking changes in Falco 0.36.0

[LucaGuerra]

What to document

Document all breaking changes, features and flags removed or modified for Falco 0.36.0

• The rules that are shipped with Falco by default are drastically different from version 0.35.x. They have been improved, split into several files, and the minimal set of rules has been changed.
• The Falco HTTP output no longer logs to stdout by default for performance reasons. You can set stdout logging preferences and restore the previous behavior with the configuration option http_output.echo in falco.yaml : cleanup(userspace/falco)!: improvements to the http output perf. #2602
• The falcosecurity/falco-driver-loader container image is now based on Debian 12 ("bookworm") stable. The set of compilers installed is also updated, improving its compatibility with newer kernels (5.x and above) but potentially affecting compilation on older kernels. The older image, meant for compatibility with older kernels (4.x and below), is currently retained as falcosecurity/falco-driver-loader-legacy. new(falco): update the Falco base image to debian 12 #2718
• The --list-syscall-events command line option has been replaced by --list-events which prints all supported system events (syscall, tracepoints, metaevents, internal plugin events) in addition to extra information about flags. new(falco): print all events with flags #2771
• The -d daemonize option has been removed feat(userspace): deprecate -d daemonize option #2677
• The -p flag behavior is now slightly changed: Improve -p as needed by latest "Style Guide of Falco Rules" #2737
• The stats command line option has been removed in favor of metrics configs in falco.yaml: feat(userspace)!: deprecate stats command args option in favor of metrics configs in falco.yaml #2739

[LucaGuerra]

These have been documented in the release notes & blog posts!