Track environment variables managed by Falco

[FedeDP]

What to document

Falco 0.37.0 will support multiple environment variables; here is a list:

• SKIP_DRIVER_LOADER used by Falco fat image to skip the driver loading part
• HOST_ROOT to set an host system root different from / (useful when running in a container; automatically set by falco, falco-driver-loader and falco-driver-loader-legacy docker images to /host)
• FALCO_HOSTNAME to override machine hostname
• FALCO_CGROUP_MEM_PATH to be set to a filepath containing memory usage
• FALCO_FRONTEND useful to be set to noninteractive to skip dialog choice during Falco deb/rpm packages installation. This is somewhat similar to DEBIAN_FRONTEND
• FALCO_DRIVER_CHOICE useful to be set to kmod, ebpf or modern_ebpf (same names as engine.kind in Falco config) during Falco deb/rpm package installation, to skip dialog choice but still retain the driver configuration
• FALCOCTL_ENABLED useful to be set to no during Falco deb/rpm packages installation, to disabling the automatic artifacts follow by falcoctl
• FALCO_BPF_PROBE DEPRECATED IN 0.37.0 and will be removed in 0.38.0 to set the path to the bpf probe to be used by Falco

/cc @falcosecurity/falco-website-maintainers

Tasks

Preview Give feedback

1. Naming consistency check before releasing
2. Update documentation

[FedeDP]

/milestone 0.37.0

[incertum]

@FedeDP 🚀 could we also update the comments in the falo.yaml around env variables (at the top, see here)? Thank you.

Re FALCO_BPF_PROBE DEPRECATED IN 0.37.0 and will be removed in 0.38.0 to set the path to the bpf probe to be used by Falco what should adopters use instead to customize the bpf probe path? I would include such a statement. I gave similar feedback around updating the deprecation notice message, see #2931.