[RHEL8] Installation fails of Falco 0.41.3-1

[MprBol]

Describe the bug

Error: Could not update: Execution of '/bin/dnf -d 0 -e 1 -y upgrade falco-0.41.3-1' returned 1: Error:
 Problem: cannot install the best update candidate for package falco-0.39.1-1.x86_64
  - nothing provides libstdc++.so.6(GLIBCXX_3.4.26)(64bit) needed by falco-0.41.3-1.x86_64 from falco
Error: /Stage[base]/Bol_falco::Install/Package[falco]/ensure: change from '0.39.1-1' to '0.41.3-1' failed: Could not update: Execution of '/bin/dnf -d 0 -e 1 -y upgrade falco-0.41.3-1' returned 1: Error:
 Problem: cannot install the best update candidate for package falco-0.39.1-1.x86_64
  - nothing provides libstdc++.so.6(GLIBCXX_3.4.26)(64bit) needed by falco-0.41.3-1.x86_64 from falco

How to reproduce it

/bin/dnf -d 0 -e 1 -y upgrade falco-0.41.3-1

on RHEL8

Expected behaviour

Installation to succeed

Screenshots

Environment

• Falco version:

trying to upgrade to falco-0.41.3-1

• System info:

{
"machine": "x86_64",
"nodename": "tst-nessusscan-app-101.bolcom.net",
"release": "4.18.0-553.54.1.el8_10.x86_64",
"sysname": "Linux",
"version": "#1 SMP Sat May 17 16:41:33 EDT 2025"
}

• Cloud provider or hardware configuration:
• OS:

NAME="Red Hat Enterprise Linux"
VERSION="8.10 (Ootpa)"

• Kernel:

Linux tst-nessusscan-app-101.bolcom.net 4.18.0-553.54.1.el8_10.x86_64 #1 SMP Sat May 17 16:41:33 EDT 2025 x86_64 x86_64 x86_64 GNU/Linux

• Installation method:
  RPM

[leogr]

ACK.

Thank you for reporting!

/milestone 0.42.0

[leogr]

Update:

Based on my search, it seems that RHEL8 officially supports up to GLIBCXX_3.4.25 as the highest version of libstdc++, but we require 3.4.26 :/

[MprBol]

is a downgrade possible for those deps so Falco works on RHEL8? Could RHEL8 and OL8 be added to the testing-suite maybe?

[leogr]

is a downgrade possible for those deps so Falco works on RHEL8?

It’s not about downgrading Falco’s deps. RHEL 8’s libstdc++ (GCC 8) only provides symbols up to GLIBCXX_3.4.25, while Falco binary stack was built against a newer libstdc++. We currently use zig toolchain to build Faclo, and we have to investigate what we can do to address this eventually.

Could RHEL8 and OL8 be added to the testing-suite maybe?
AFAIK, RHEL8 requires a subscription to be used in a CI, and we don't have it. @Molter73, any idea? (We may use UBI, I started a discussion with the CNCF about it but I'm still unsure).

[MprBol]

Thank you! Is it an idea to document that RHEL/OL8 is not officially supported right now, and retroactively mark the upgrade has a breaking change? Which Falco version is the latest supported for RHEL8/OL8 ?

[leogr]

Thank you! Is it an idea to document that RHEL/OL8 is not officially supported right now, and retroactively mark the upgrade has a breaking change?

Since we do want to support the RHEL family (although our support may be considered similar to what many other projects call "community support"), I consider this issue mostly a bug, not an interruption in supporting it.

Also, in my last comment, I forgot to mention that GLIBCXX_3.4.26 is not directly required by Falco, but by the container plugin (which becomes part of the default Falco distribution starting from 0.41). This also means that we might fix the problem in the plugin and issue a patch release to make Falco 0.41.x version compatible again with RHEL.

Which Falco version is the latest supported for RHEL8/OL8 ?

So, as explained above, the problem started with 0.41. Previous versions should work fine on RHEL/OL.

PS
I apologize if any of my previous comments were not clear enough; I just wrote them in a rush. I hope you understand 🙏

[leogr]

Also, re documentation: we are tentatively planning to address this within Falco 0.42 (due by the end of Sept). Once we have a clear idea of the outcome, we will document it accordingly (and retroactively if needed).