Patch vuln attack surface

[parisnakitakejser]

This patch upgrades the driver Dockerfile to support Debian 13.

The current driver image contains over 2000 known vulnerabilities. This update aims to significantly reduce that number by moving to a more secure and up-to-date base image, improving the overall security posture of the runtime environment.

[poiana]

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[poiana]

Welcome @parisnakitakejser! It looks like this is your first PR to falcosecurity/falco 🎉

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: parisnakitakejser
Once this PR has been reviewed and has the lgtm label, please assign leogr for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• docker/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[leogr]

Hey @parisnakitakejser, thanks for looking into this!

The apt-key modernization and the gnupg2 👉 gnupg change are good improvements 👍

However, upgrading the base image to debian:13-slim and dropping gcc-11 is something we can't do. The falco-driver-loader image exists to compile kernel modules and legacy eBPF probes on-the-fly on user systems. The GCC version must be compatible with the one used to build the running kernel, and different kernel versions require different GCC versions (e.g., kernel 5.x needs gcc-11, kernel 6.0-6.4 needs gcc-12).

By bumping to Debian 13, the default gcc would jump to 14.x (only valid for kernel 6.9+) and gcc-11 would no longer be available from apt. That would break driver compilation for anyone running kernel 5.x or 6.0-6.8.

N.B. the main falcosecurity/falco image is already based on Wolfi (not Debian) and is not affected by Debian CVEs. The -debian variant and the driver-loader image are Debian-based specifically because of the build toolchain requirements. They use old Debian versions on purpose, and the CVEs reported can't be really exploited because the affected tools are only used to build the driver (during the init phase) and not to run Falco.

May you consider splitting this PR? The apt-key and gnupg fixes could be submitted separately and would likely be accepted. The base image bump needs a broader discussion since it impacts driver compatibility.

Thanks 🙏

/kind cleanup
/area build