Skip to content

docs: bpfcompat now runs upstream in falcosecurity/libs CI#81

Merged
ErenAri merged 2 commits into
mainfrom
docs/falco-upstream-merge
Jul 15, 2026
Merged

docs: bpfcompat now runs upstream in falcosecurity/libs CI#81
ErenAri merged 2 commits into
mainfrom
docs/falco-upstream-merge

Conversation

@ErenAri

@ErenAri ErenAri commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

What

falcosecurity/libs#3024 merged on 2026-07-15: a scheduled CI lane in falcosecurity/libs builds Falco's real userspace loader (scap-open, statically linked, modern_bpf probe embedded) and validates it inside each matrix kernel VM via bpfcompat command mode (workflow).

Update the docs to reflect it:

  • README: "Runs upstream" callout near the top + graduate the "Proof: a real Falco probe" section from standalone evidence to merged upstream CI.
  • docs/case-study-falco-modern-bpf.md: new "Upstream" section explaining the scap-open command-mode lane (the loader is the contract — no manifest to keep in sync); bump the stale v0.2.0 action pin in the reproduce snippet to v0.3.0.
  • docs/command-validation.md: real-world example under the GitHub Action section.

Verification

The exact merged workflow was dress-rehearsed on a fork (ErenAri/libs run 29422004424): scap-open static build + 3-kernel matrix all pass (ubuntu-22.04-5.15 / debian-12-6.1 / ubuntu-24.04-6.8) — after adding libbpf-dev/zlib1g-dev to the runner deps (upstream fix branch prepared separately). Wording stays factual (a workflow exists and runs) — no endorsement claims.

🤖 Generated with Claude Code

falcosecurity/libs#3024 merged 2026-07-15: a scheduled lane in
falcosecurity/libs builds Falco's real userspace loader (scap-open,
statically linked, modern_bpf probe embedded) and validates it per
kernel via bpfcompat command mode — the loader's exit code is the
per-kernel verdict, no manifest to keep in sync.

- README: 'Runs upstream' callout + graduate the Falco proof section
  from standalone evidence to merged upstream CI
- case-study-falco-modern-bpf.md: upstream-adoption section; bump the
  stale v0.2.0 action pin in the reproduce snippet to v0.3.0
- command-validation.md: real-world example under the GitHub Action
  section

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 15, 2026 14:09

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@ErenAri
ErenAri merged commit cbef9f5 into main Jul 15, 2026
7 checks passed
@ErenAri
ErenAri deleted the docs/falco-upstream-merge branch July 15, 2026 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants