# Blog: Introducing Falco 0.44.0

DevFeed: [Blog: Introducing Falco 0.44.0](<https://devfeed.tech/articles/blog-introducing-falco-0-44-0-32494.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-0-44-0/>)

Published: 2026-05-26T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [eBPF](<https://devfeed.tech/topics/ebpf.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [cli](<https://devfeed.tech/tags/cli.md>), [deprecated](<https://devfeed.tech/tags/deprecated.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [falco](<https://devfeed.tech/tags/falco.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [release](<https://devfeed.tech/tags/release.md>), [version](<https://devfeed.tech/tags/version.md>)

## AI overview

Falco 0.44.0 removes the legacy eBPF probe, gVisor engine, and gRPC output and server. The release adds rule-language list modifiers, a hard capture-file size limit, stricter schema validation, JSON output for listing commands, faster process-tree lookups, and multi-thread safety fixes. It also includes updated libraries, drivers, plugins, and rules.

## Source excerpt

Dear Falco Community, we are happy to announce the release of Falco 0.44.0 today! This release completes the deprecation cycle started in 0.42.0 and 0.43.0: the legacy eBPF probe, the gVisor engine, and the gRPC output (along with the gRPC server) are now fully removed from the entire stack. On top of that, 0.44.0 brings new rule-language capabilities, a long-requested safety knob for the capture feature, JSON output for the --list family of commands, a substantial round of performance work on process tree lookups, and a wave of multi-thread safety fixes that lay the groundwork for the upcoming multi-threaded Falco architecture. During this release cycle, we merged: 60 PRs on Falco, including 14 release note-worthy changes 160 PRs on Falco libs, including 54 release note-worthy changes 16 PRs on Falco drivers, including 3 release note-worthy changes We upgraded libs to version 0.25.2 and drivers to 10.2.0+driver. We also ship falcoctl 0.13.0, the container plugin 0.7.1, and the falco-rules ruleset 5.1.0. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Major features and improvements: Comparison operator list modifiers (oneof/anyof/allof) Hard limit on capture file size Stricter rule schema validation Backslash escaping in -o dotted key paths JSON output for the listing CLI commands Faster process tree lookups Multi-thread safety hardening Drivers: The kernel module pre-builds for this release are still being produced and will be available within a couple of days from the release. In the meantime, falcoctl can build the kernel module locally on the host. Drivers: new syscall, kernel 7.0, and BPF iterators Plugins: Container plugin fix for containerd v2.3.0 Plugin library path traversal hardening Event generator: Event generator: HTTP output and new suite namespace Rules: Updated ruleset (falco-rules 5.1.0) Kubernetes: Kubernetes Oper