Skip to content

[WIP] feat(falco): experimental multi-thread support#3833

Draft
irozzo-1A wants to merge 5 commits intofalcosecurity:masterfrom
irozzo-1A:experimental/multi-thread
Draft

[WIP] feat(falco): experimental multi-thread support#3833
irozzo-1A wants to merge 5 commits intofalcosecurity:masterfrom
irozzo-1A:experimental/multi-thread

Conversation

@irozzo-1A
Copy link
Copy Markdown
Contributor

@irozzo-1A irozzo-1A commented Mar 22, 2026 •
edited
Loading

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it:

The libs branch with multi-thread support can be found here.

To build assuming the two repositories are in the same directory, use the following:

cd falco
cmake -B build \
  -DUSE_JEMALLOC=ON \
  -DUSE_GPERFTOOLS=ON \
  -DBUILD_BPF=OFF \
  -DBUILD_DRIVER=OFF \
  -DBUILD_LIBSCAP_MODERN_BPF=ON \
  -DENABLE_E2E_TESTS=OFF \
  -DUSE_BUNDLED_DEPS=ON \
  -DCMAKE_BUILD_TYPE=RelWithDebInfo \
  -DFALCOSECURITY_LIBS_SOURCE_DIR=$(pwd)/../libs \
  . && cmake --build build --target falco -j$(nproc)

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

irozzo-1A and others added 5 commits March 11, 2026 11:35
@irozzo-1A
feat(userspace/engine): update libs ref and adapt to transformer AST …
c0bf81d 
…changes

- Bump default falcosecurity/libs to latest main (8f6b914) with
  transformer_list_expr and field_transformer_expr (values) support
- Add visit(transformer_list_expr*) to filter_details_resolver and
  filter_macro_resolver visitors
- Fix field_transformer_expr handling to use e->values instead of e->value

Signed-off-by: irozzo-1A <[email protected]>
@irozzo-1A
feat(experimental): multi-thread event processing with TGID-partition…
3684d10 
…ed buffers

- Add num_worker_threads to modern_ebpf config (falco.yaml, configuration, schema)
- Open live inspector with buffers_num = num_worker_threads when > 1
- Validate syscall buffer count for multi-thread in configure_syscall_buffer_num
- Add push_ctrl_msg() to falco_outputs for workers to push pre-formatted messages
- Implement do_inspect_multi_thread() with per-worker engines, formats, buffer handles
- Add design proposal 20251205-multi-thread-falco-design-review.md
- Engine: filter_details_resolver and filter_macro_resolver AST visitor updates

Made-with: Cursor
Signed-off-by: Iacopo Rozzo <iacopo.rozzo@localhost>
@irozzo-1A
chore(cmake): add use TSAN option
609840c 
Signed-off-by: irozzo-1A <[email protected]>
@irozzo-1A
fix(userspace/engine): remove duplicate methods
727b36d 
Signed-off-by: irozzo-1A <[email protected]>
@irozzo-1A
fix(userspace/falco): fix watchdog race condition
0bc2209 
Signed-off-by: irozzo-1A <[email protected]>
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Mar 22, 2026

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Mar 22, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: irozzo-1A
Once this PR has been reviewed and has the lgtm label, please assign fededp for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana requested review from Kaizhe and ekoops March 22, 2026 09:29
@irozzo-1A irozzo-1A mentioned this pull request Mar 22, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ekoops ekoops Awaiting requested review from ekoops

@Kaizhe Kaizhe Awaiting requested review from Kaizhe

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dco-signoff: yes do-not-merge/release-note-label-needed do-not-merge/work-in-progress size/XXL

Projects

Falco Roadmap
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@irozzo-1A @poiana