mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-09 02:29:36 +00:00
updates based on code review rnd 1
Signed-off-by: Michael Ducy <michael@ducy.org>
This commit is contained in:
Michael Ducy
committed by
Leo Di Donato
Leo Di Donato
parent
01abe71256
commit
5a703ddbb8
30
docker/README.md
Normal file
30
docker/README.md
Normal file
@@ -0,0 +1,30 @@
|
||||
# Falco Dockerfiles
|
||||
|
||||
This directory contains the various ways to package Falco as a container.
|
||||
|
||||
## Currently Supported Containers
|
||||
|
||||
### `falcosecurity/falco` Dockerfiles
|
||||
- `./dev`: Builds a container image from the `dev` apt repo.
|
||||
- `./stable`: Builds a container image from the `stable` apt repo.
|
||||
- `./local`: Builds a container image from a locally provided Falco `dpkg` package.
|
||||
|
||||
### Build & Testing Dockerfiles
|
||||
- `./builder`: `falcosecurity/falco-builder` - The complete build tool chain for compiling Falco from source. See [the documentation](https://falco.org/docs/source/) for more details on building from source.
|
||||
- `./tester`: `falcosecurity/falco-tester` - Container image for running the Falco test suite.
|
||||
|
||||
## Alpha Release Containers
|
||||
|
||||
These Dockerfiles (and resulting container images) are currently in `alpha`. We'd love for you to test these images and [report any feedback](https://github.com/falcosecurity/falco/issues/new/choose).
|
||||
|
||||
### Slim and Minimal Dockerfiles
|
||||
The goal of these container images is to reduce the size of the underlying Falco container.
|
||||
- `./slim-dev`: Like `./dev` above but removes build tools for older kernels.
|
||||
- `./slim-stable`: Like `./stable` above but removes build tools for older kernels.
|
||||
- `./minimal`: A minimal container image (~20mb), containing only the files required to run Falco.
|
||||
|
||||
### Init Containers
|
||||
These container images allow for the delivery of the kernel module or eBPF probe either via HTTP or via a container image.
|
||||
- `kernel/linuxkit`: Multistage Dockerfile to build a Falco kernel module for Linuxkit (Docker Desktop). Generates an alpine based container image with the kernel module, and `insmod` as the container `CMD`.
|
||||
- `kernel/httploader`: Multistage Dockerfile to build a Go based application to download (via HTTPS) and load a Falco kernel module. The resulting container image can be ran as an `initContainer` to load the Falco module before Falco starts.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
FROM debian:unstable
|
||||
|
||||
LABEL maintainer="Sysdig <support@sysdig.com>"
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_REPOSITORY dev
|
||||
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
FROM alpine:latest
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
RUN apk add --no-cache bash g++
|
||||
COPY ./event_generator.cpp /usr/local/bin
|
||||
RUN mkdir -p /var/lib/rpm
|
||||
|
||||
@@ -2,10 +2,15 @@ FROM golang:alpine AS build
|
||||
|
||||
RUN apk --no-cache add build-base git bzr mercurial gcc ca-certificates
|
||||
|
||||
ADD ./httploader /src
|
||||
RUN cd /src && go get golang.org/x/sys/unix && CGO_ENABLED=0 GOOS=linux go build -a -o httploader -ldflags '-extldflags "-static"' .
|
||||
ADD ./cmd /src/cmd
|
||||
ADD ./pkg /src/pkg
|
||||
ADD ./go.mod /src/go.mod
|
||||
ADD ./go.sum /src/
|
||||
|
||||
RUN cd /src && CGO_ENABLED=0 GOOS=linux go build -a -o httploader -ldflags '-extldflags "-static"' cmd/httploader/main.go
|
||||
|
||||
FROM scratch
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
||||
COPY --from=build /src/httploader /
|
||||
ENTRYPOINT /httploader
|
||||
COPY --from=build /src/httploader /httploader
|
||||
CMD [ "/httploader" ]
|
||||
|
||||
@@ -1,148 +0,0 @@
|
||||
package falcoloader
|
||||
|
||||
import "io/ioutil"
|
||||
import "io"
|
||||
import "os"
|
||||
import "crypto/md5"
|
||||
import "encoding/hex"
|
||||
import "strings"
|
||||
import "net/http"
|
||||
import "golang.org/x/sys/unix"
|
||||
import "log"
|
||||
import "unsafe"
|
||||
import "compress/gzip"
|
||||
import "bytes"
|
||||
|
||||
func GetKernelVersion() string {
|
||||
path := "/proc/version"
|
||||
|
||||
file, err := ioutil.ReadFile(path)
|
||||
if err != nil {
|
||||
return "invaildVersion"
|
||||
}
|
||||
version_string := string(file)
|
||||
|
||||
version_fields := strings.Split(version_string, " ")
|
||||
|
||||
return version_fields[2]
|
||||
}
|
||||
|
||||
func GetKernelConfigHash() string {
|
||||
var hash string
|
||||
kernelConfigPath := getKernelConfigPath()
|
||||
hash, _ = genKernelConfigHash(kernelConfigPath)
|
||||
|
||||
return hash
|
||||
}
|
||||
|
||||
func getKernelConfigPath() string {
|
||||
kernelConfigPath := ""
|
||||
|
||||
version := GetKernelVersion()
|
||||
paths := []string{
|
||||
"/proc/config.gz",
|
||||
"/boot/config-" + version,
|
||||
"/host/boot/config-" + version,
|
||||
"/usr/lib/ostree-boot/config-" + version,
|
||||
"/usr/lib/ostree-boot/config-" + version,
|
||||
"/lib/modules/" + version + "/config" }
|
||||
|
||||
for i := range paths {
|
||||
_, err := os.Stat(paths[i])
|
||||
if err != nil {
|
||||
continue;
|
||||
}
|
||||
log.Print("Found kernel config: " + paths[i])
|
||||
return paths[i]
|
||||
}
|
||||
log.Fatal("No kernel config found")
|
||||
return kernelConfigPath
|
||||
}
|
||||
|
||||
func genKernelConfigHash(path string) (string, error) {
|
||||
var md5hash string
|
||||
var err error
|
||||
var buf bytes.Buffer
|
||||
|
||||
if strings.HasSuffix(path, "gz") {
|
||||
log.Print("Kernel config " + path + " is gz compressed")
|
||||
tmpfile, err := os.Open(path)
|
||||
if err != nil {
|
||||
return md5hash, err
|
||||
}
|
||||
defer tmpfile.Close()
|
||||
|
||||
file, err := gzip.NewReader(tmpfile)
|
||||
if err != nil {
|
||||
return md5hash, err
|
||||
}
|
||||
defer file.Close()
|
||||
io.Copy(&buf, file)
|
||||
} else {
|
||||
file, err := os.Open(path)
|
||||
if err != nil {
|
||||
return md5hash, err
|
||||
}
|
||||
defer file.Close()
|
||||
io.Copy(&buf,file)
|
||||
}
|
||||
|
||||
hash := md5.New()
|
||||
if _, err := io.Copy(hash, &buf); err != nil {
|
||||
return md5hash, err
|
||||
}
|
||||
md5hash = hex.EncodeToString(hash.Sum(nil))
|
||||
log.Print("Hash calculated: " + md5hash)
|
||||
|
||||
return md5hash, err
|
||||
|
||||
}
|
||||
|
||||
func FetchModule(url string, path string) error {
|
||||
log.Printf("Downloading kernel module from %s", url)
|
||||
resp, err := http.Get(url)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
log.Printf("Recevied HTTP Status Code: %d", resp.StatusCode)
|
||||
if resp.StatusCode == 200 {
|
||||
out, err := os.Create(path)
|
||||
if err != nil {
|
||||
log.Fatalf("Error creating file: %s", path)
|
||||
return err
|
||||
}
|
||||
defer out.Close()
|
||||
|
||||
_, err = io.Copy(out, resp.Body)
|
||||
if err != nil {
|
||||
log.Fatalf("Unable to write file: %s", path)
|
||||
return err
|
||||
}
|
||||
log.Printf("Wrote kernel module: %s", path)
|
||||
} else {
|
||||
log.Fatal("Non-200 Status code received.")
|
||||
}
|
||||
return err
|
||||
|
||||
}
|
||||
|
||||
func LoadModule(path string) error {
|
||||
|
||||
file, err := os.Open(path)
|
||||
if err != nil {
|
||||
log.Fatalf("Error opening kernel module: %s", path)
|
||||
return err
|
||||
}
|
||||
|
||||
log.Print("Opened probe: " + path)
|
||||
|
||||
_p0, err := unix.BytePtrFromString("")
|
||||
|
||||
if _, _, err := unix.Syscall(313, file.Fd(), uintptr(unsafe.Pointer(_p0)), 0); err != 0 {
|
||||
log.Fatalf("Error loading kernel module: %s. The module may already be loaded.", path)
|
||||
return err
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
@@ -1,50 +0,0 @@
|
||||
package main
|
||||
|
||||
import "os"
|
||||
import "log"
|
||||
import "fmt"
|
||||
import "./falcoloader"
|
||||
|
||||
// Default behavior: calculate kernel module and download from Falco hosted probe library
|
||||
// ENV FALCO_PROBE_URL = URL to download probe.ko file
|
||||
// ENV FALCO_PROBE_REPO = URL to download probe.ko, probe name derived from `uname -r`
|
||||
|
||||
func main() {
|
||||
falco_version := getEnv("FALCO_VERSION","0.17.0")
|
||||
falco_probe_path := getEnv("FALCO_PROBE_PATH","/")
|
||||
falco_probe_file := getEnv("FALCO_PROBE_FILE","falco-probe.ko")
|
||||
falco_probe_fullpath := falco_probe_path + falco_probe_file
|
||||
falco_probe_url := getEnv("FALCO_PROBE_URL","")
|
||||
falco_probe_repo := getEnv("FALCO_PROBE_REPO","https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/")
|
||||
falco_config_hash := falcoloader.GetKernelConfigHash()
|
||||
falco_kernel_version := falcoloader.GetKernelVersion()
|
||||
|
||||
log.Printf("FALCO_VERSION: %s", falco_version)
|
||||
log.Printf("FALCO_PROBE_URL: %s", falco_probe_url)
|
||||
log.Printf("FALCO_PROBE_REPO: %s", falco_probe_repo)
|
||||
log.Printf("KERNEL_VERSION: %s", falco_kernel_version)
|
||||
log.Printf("KERNEL_CONFIG_HASH: %s", falco_config_hash)
|
||||
|
||||
// if FALCO_PROBE_URL not set, build it
|
||||
if falco_probe_url == "" {
|
||||
falco_probe_url = fmt.Sprintf("%sfalco-probe-%s-x86_64-%s-%s.ko", falco_probe_repo, falco_version, falco_kernel_version, falco_config_hash)
|
||||
}
|
||||
|
||||
// fetch module
|
||||
if err := falcoloader.FetchModule(falco_probe_url, falco_probe_fullpath); err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
// load module
|
||||
if err := falcoloader.LoadModule(falco_probe_fullpath); err != nil {
|
||||
panic(err)
|
||||
}
|
||||
}
|
||||
|
||||
func getEnv(key, def string) string {
|
||||
value, isSet := os.LookupEnv(key)
|
||||
if (isSet) {
|
||||
return value
|
||||
}
|
||||
return def
|
||||
}
|
||||
@@ -1,5 +1,7 @@
|
||||
FROM ubuntu:18.04 as ubuntu
|
||||
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ARG FALCO_VERSION=0.17.0
|
||||
|
||||
ENV FALCO_VERSION=${FALCO_VERSION}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
FROM ubuntu:18.04
|
||||
|
||||
LABEL maintainer="Sysdig <support@sysdig.com>"
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_REPOSITORY dev
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
FROM ubuntu:18.04
|
||||
|
||||
LABEL maintainer="Sysdig <support@sysdig.com>"
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_REPOSITORY stable
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
FROM debian:unstable
|
||||
|
||||
LABEL maintainer="Sysdig <support@sysdig.com>"
|
||||
LABEL maintainer="opensource@sysdig.com"
|
||||
|
||||
ENV FALCO_REPOSITORY stable
|
||||
|
||||
|
||||
Reference in New Issue
Block a user