diff --git a/docker/docker-compose/README.md b/docker/docker-compose/README.md index bd23ec6f..4c67432c 100644 --- a/docker/docker-compose/README.md +++ b/docker/docker-compose/README.md @@ -1,4 +1,4 @@ -# A Warning +# Warning This environment is provided for demonstration purposes only and does not represent a production ready deployment of falco # Components @@ -6,6 +6,7 @@ The components that this docker-compose file spins up are falco, falcosidekick, # Running To start this environment run `docker-compose up` +Note: You may need to use sudo for falco to start correctly. # Cleaning up To clean up run `docker-compose rm` diff --git a/docker/docker-compose/config/http_output.yml b/docker/docker-compose/config/http_output.yml new file mode 100644 index 00000000..bef6dbf4 --- /dev/null +++ b/docker/docker-compose/config/http_output.yml @@ -0,0 +1,10 @@ +# [Stable] `http_output` +# +# Send logs to an HTTP endpoint or webhook. +# +# When using falcosidekick, it is necessary to set `json_output` to true. +json_output: true +json_include_output_property: true +http_output: + enabled: true + url: "http://falco-sidekick:2801/" \ No newline at end of file diff --git a/docker/docker-compose/docker-compose.yaml b/docker/docker-compose/docker-compose.yaml index c4b0ac43..1b632962 100644 --- a/docker/docker-compose/docker-compose.yaml +++ b/docker/docker-compose/docker-compose.yaml @@ -12,7 +12,7 @@ services: - /var/run/docker.sock:/host/var/run/docker.sock - /proc:/host/proc:ro - /etc:/host/etc:ro - command: '/usr/bin/falco -o http_output.enabled=true -o http_output.url="http://falco-sidekick:2801/"' + - ./config/http_output.yml:/etc/falco/config.d/http_output.yml image: falcosecurity/falco-no-driver:latest sidekick: