# Blog: Introducing Falco 0.41.0

DevFeed: [Blog: Introducing Falco 0.41.0](<https://devfeed.tech/articles/blog-introducing-falco-0-41-0-32491.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-0-41-0/>)

Published: 2025-05-29T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [eBPF](<https://devfeed.tech/topics/ebpf.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [container](<https://devfeed.tech/topics/container.md>), [JSON](<https://devfeed.tech/topics/json.md>), [Prometheus](<https://devfeed.tech/topics/prometheus.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Code Modularity](<https://devfeed.tech/topics/code-modularity.md>)

Tags: [bug-fixes](<https://devfeed.tech/tags/bug-fixes.md>), [capabilities](<https://devfeed.tech/tags/capabilities.md>), [changes](<https://devfeed.tech/tags/changes.md>), [code-modularity](<https://devfeed.tech/tags/code-modularity.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [container](<https://devfeed.tech/tags/container.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [falco](<https://devfeed.tech/tags/falco.md>), [json](<https://devfeed.tech/tags/json.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [prometheus](<https://devfeed.tech/tags/prometheus.md>), [release](<https://devfeed.tech/tags/release.md>), [ux](<https://devfeed.tech/tags/ux.md>)

## AI overview

Falco 0.41.0 introduces revised container engine support, an early Kubernetes operator, configurable merge strategies, expanded eBPF driver behavior, new field access options, and JSON output controls. The release also includes fixes for kernel-module crashes, Prometheus metrics, RPM scripts, and configuration overrides.

## Source excerpt

Dear Falco Community, today we are happy to announce the release of Falco 0.41.0! This version brings several new features, performance enhancements, and bug fixes that streamline Falco's detection capabilities. During this release cycle, we merged more than 50 PRs on Falco and around 130 PRs for libs and drivers, version 0.21.0 and version 8.1.0, respectively. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Key features: Reimplemented container engines support from scratch; A Kubernetes operator is taking shape; Falco's config_files configuration gained support to specify the merge strategy; Modern eBPF driver is now capable of trying to load multiple programs for each event; consequently, sendmmsg and recvmmsg will now make use of bpf_loop eBPF helper where available, boosting their performances; New proc.aargs field available, ie: a lookup for an ancestor args field; proc.args gained support for indexed access, to only check a certain argument; json_include_output_fields configuration key for Falco to control whether output fields are included in the JSON message; Ongoing work to improve libs code modularity; Key fixes: Avoid kmod crashing when a CPU gets enabled at runtime; Fixed Falco Prometheus metrics with multiple event sources enabled; Fixed RPM packages evaluation of RPM scripts; -o options do now correctly override included config_files; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.41.0 release contains a number of features and UX improvements. Here is a list of some of the key new capabilities. Reimplemented container engines support In the Falco 0.41.0 release, the Falco team has completely revised its support for container engines. Key improvements include: Container support is now a plugin; The plugin will attach a listener to the eng