mirror of
https://github.com/falcosecurity/falco.git
synced 2025-06-29 16:17:32 +00:00
update(proposals): artifacts storage proposal
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato
poiana
parent
2d24df1ce2
commit
d80ffeae5b
@ -4,7 +4,7 @@ The **Falco Artifact Scope** proposal is divided in two parts:
|
||||
1. the Part 1 - *this document*: the State of Art of Falco artifacts
|
||||
2. the [Part 2](./20200506-artifacts-scope-part-2.md): the intended state moving forward
|
||||
|
||||
## Summary
|
||||
## Summary
|
||||
|
||||
As a project we would like to support the following artifacts.
|
||||
|
||||
@ -16,7 +16,7 @@ Inspired by many previous issues and many of the weekly community calls.
|
||||
|
||||
## Terms
|
||||
|
||||
**falco**
|
||||
**falco**
|
||||
|
||||
*The Falco binary*
|
||||
|
||||
@ -30,12 +30,12 @@ Inspired by many previous issues and many of the weekly community calls.
|
||||
|
||||
**package**
|
||||
|
||||
*An installable artifact that is operating system specific. All packages MUST be hosted on bintray.*
|
||||
*An installable artifact that is operating system specific. All packages MUST be hosted on [bintray](https://bintray.com/falcosecurity).*
|
||||
|
||||
**image**
|
||||
|
||||
*OCI compliant container image hosted on dockerhub with tags for every release and the current master branch.*
|
||||
|
||||
|
||||
|
||||
# Packages
|
||||
|
||||
@ -52,11 +52,11 @@ List of currently official container images (for X86 64bits only):
|
||||
|
||||
| Name | Directory | Description |
|
||||
|---|---|---|
|
||||
| [falcosecurity/falco:latest](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:master](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/stable | Falco (DEB built from git tag or from the master) with all the building toolchain. |
|
||||
| [falcosecurity/falco:latest-slim](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_-slim](https://hub.docker.com/repository/docker/falcosecurity/falco),[falcosecurity/falco:master-slim](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/slim | Falco (DEB build from git tag or from the master) without the building toolchain. |
|
||||
| [falcosecurity/falco-driver-loader:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:master](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader) | docker/driver-loader | `falco-driver-loader` as entrypoint with the building toolchain. |
|
||||
| [falcosecurity/falco-builder:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-builder) | docker/builder | The complete build tool chain for compiling Falco from source. See [the documentation](https://falco.org/docs/source/) for more details on building from source. Used to build Falco (CI). |
|
||||
| [falcosecurity/falco-tester:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-tester) | docker/tester | Container image for running the Falco test suite. Used to run Falco integration tests (CI). |
|
||||
| [falcosecurity/falco:latest](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:master](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/stable | Falco (DEB built from git tag or from the master) with all the building toolchain. |
|
||||
| [falcosecurity/falco:latest-slim](https://hub.docker.com/repository/docker/falcosecurity/falco), [falcosecurity/falco:_tag_-slim](https://hub.docker.com/repository/docker/falcosecurity/falco),[falcosecurity/falco:master-slim](https://hub.docker.com/repository/docker/falcosecurity/falco) | docker/slim | Falco (DEB build from git tag or from the master) without the building toolchain. |
|
||||
| [falcosecurity/falco-driver-loader:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:_tag_](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader), [falcosecurity/falco-driver-loader:master](https://hub.docker.com/repository/docker/falcosecurity/falco-driver-loader) | docker/driver-loader | `falco-driver-loader` as entrypoint with the building toolchain. |
|
||||
| [falcosecurity/falco-builder:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-builder) | docker/builder | The complete build tool chain for compiling Falco from source. See [the documentation](https://falco.org/docs/source/) for more details on building from source. Used to build Falco (CI). |
|
||||
| [falcosecurity/falco-tester:latest](https://hub.docker.com/repository/docker/falcosecurity/falco-tester) | docker/tester | Container image for running the Falco test suite. Used to run Falco integration tests (CI). |
|
||||
| _to not be published_ | docker/local | Built on-the-fly and used by falco-tester. |
|
||||
|
||||
**Note**: `falco-builder`, `falco-tester` (and the `docker/local` image which it's built on the fly by the `falco-tester` one) are not integrated into the release process because they are development and CI tools that need to be manually pushed only when updated.
|
||||
@ -76,7 +76,7 @@ This new [contrib](https://github.com/falcosecurity/contrib) repository will be
|
||||
|
||||
### repository
|
||||
|
||||
"_Incubating level_" projects such as [falco-exporter](https://github.com/falco-exporter) can be promoted from `contrib` to their own repository.
|
||||
"_Incubating level_" projects such as [falco-exporter](https://github.com/falco-exporter) can be promoted from `contrib` to their own repository.
|
||||
|
||||
This is done as needed, and can best be measured by the need to cut a release and use the GitHub release features. Again, this is at the discretion of the Falco open source community.
|
||||
|
||||
@ -92,7 +92,7 @@ The *Part 1* is mainly intended as a cleanup process.
|
||||
For each item not listed above, ask if it needs to be moved or deleted.
|
||||
After the cleanup process, all items will match the *Part 1* of this proposal.
|
||||
|
||||
|
||||
|
||||
### Action Items
|
||||
|
||||
Here are SOME of the items that would need to be done, for example:
|
||||
|
||||
@ -9,18 +9,18 @@ This document reflects the way we store the Falco artifacts.
|
||||
|
||||
## Packages
|
||||
|
||||
The Falco packages are **automatically** sent to [bintray](https://bintray.com/falcosecurity) in the following cases:
|
||||
The Falco packages are **automatically** built and sent to [bintray](https://bintray.com/falcosecurity) in the following cases:
|
||||
|
||||
- a pull request gets merged into the master branch (**Falco development releases**)
|
||||
- a new Falco release (git tag) happens (**Falco stable releases**)
|
||||
- a new Falco release (git tag) happens on the master branch (**Falco stable releases**)
|
||||
|
||||
The only prerequisite is that the specific Falco source code built successfully and that the tests passed.
|
||||
The only prerequisite is that the specific Falco source code builds successfully and that the tests pass.
|
||||
|
||||
As per [Falco artifacts](./20200506-artifacts-scope-part-1.md) document we ship three kind of Falco packages:
|
||||
As per [Falco Artifacts Scope (#1)](./20200506-artifacts-scope-part-1.md) proposal we provide three kind of Falco packages:
|
||||
|
||||
- DEB
|
||||
- RPM
|
||||
- Tarballs
|
||||
- Tarball
|
||||
|
||||
Thus, we have three repositories for the Falco stable releases:
|
||||
|
||||
@ -36,19 +36,40 @@ And three repositories for the Falco development releases:
|
||||
|
||||
## Drivers
|
||||
|
||||
The process of publishing a set of prebuilt Falco drivers is implemented by the **Drivers Build Grid** in the [test-infra](https://github.com/falcosecurity/test-infra/tree/master/driverkit) repository (`driverkit` directory).
|
||||
The process of publishing a set of prebuilt Falco drivers is implemented by the **Drivers Build Grid (DBG)** in the [test-infra](https://github.com/falcosecurity/test-infra/tree/master/driverkit) repository (`driverkit` directory).
|
||||
|
||||
It is driven by the configuration files (YAML) present in the `config` directory.
|
||||
Each of these files represents a prebuilt driver (eventually two: kernel module and eBPF probe) that will be published on [bintray](https://bintray.com/falcosecurity) if it builds correctly.
|
||||
This process is driven by the configuration files (YAML) present in the `driverkit/config` directory in the [test-infra](https://github.com/falcosecurity/test-infra/tree/master/driverkit) repository.
|
||||
|
||||
Each of these files represents a prebuilt driver (eventually two: kernel module and eBPF probe, when possible) that will be published on [bintray](https://bintray.com/falcosecurity) if it builds correctly.
|
||||
|
||||
Every time the `driverkit/config` directory on the master branch has some changes from the previous commit the CI system, which you can find defined in the [.circleci/config.yml](https://github.com/falcosecurity/test-infra/blob/master/.circleci/config.yml) file, takes care of building and publishing all the drivers.
|
||||
|
||||
The driver versions we ship prebuilt drivers for are:
|
||||
|
||||
- the current driver version associated with the last stable Falco version ([see here](https://github.com/falcosecurity/falco/blob/c4b7f17271d1a4ca533b2e672ecaaea5289ccdc5/cmake/modules/sysdig.cmake#L29))
|
||||
- ...
|
||||
- the driver version associated with the last stable Falco version ([see here](https://github.com/falcosecurity/falco/blob/c4b7f17271d1a4ca533b2e672ecaaea5289ccdc5/cmake/modules/sysdig.cmake#L29))
|
||||
- the driver version associated with the current development Falco version - ie., the one on [master](https://github.com/falcosecurity/falco/blob/master/cmake/modules/sysdig.cmake#L30)
|
||||
|
||||
The prebuilt drivers get published into [this](https://bintray.com/falcosecurity/driver) generic artifacts repository.
|
||||
|
||||
You can also visualize the full list of prebuilt drivers by driver version visiting this [link](https://dl.bintray.com/falcosecurity/driver).
|
||||
You can also visualize the full list of prebuilt drivers by driver version visiting this [URL](https://dl.bintray.com/falcosecurity/driver).
|
||||
|
||||
### Notice
|
||||
|
||||
The generation of new prebuilt drivers takes usually place with a frequency of 1-2 weeks.
|
||||
|
||||
Thus, it can happen the list of available prebuilt drivers does not yet contain the driver version currently on Falco master.
|
||||
|
||||
Nevertheless, this process is an open, auditable, and transparent one.
|
||||
|
||||
So, by sending a pull-request towards [test-infra](https://github.com/falcosecurity/test-infra) repository containing the configuration YAML files you can help the Falco community stay on track.
|
||||
|
||||
Some pull-requests you can look at to create your own are:
|
||||
|
||||
- https://github.com/falcosecurity/test-infra/pull/165
|
||||
- https://github.com/falcosecurity/test-infra/pull/163
|
||||
- https://github.com/falcosecurity/test-infra/pull/162
|
||||
|
||||
While, the documentation of the YAML configuration files can be found [here](https://github.com/falcosecurity/driverkit/blob/master/README.md).
|
||||
|
||||
## Container images
|
||||
|
||||
@ -57,4 +78,6 @@ As per Falco packages, also the Falco official container images are **automatica
|
||||
These images are built and published in two cases:
|
||||
|
||||
- a pull request gets merged into the master branch (**Falco development releases**)
|
||||
- a new Falco release (git tag) happens (**Falco stable releases**)
|
||||
- a new Falco release (git tag) happens (**Falco stable releases**)
|
||||
|
||||
For a detailed explanation of the container images we build and ship look at the following [documentation](https://github.com/falcosecurity/falco/blob/master/docker/README.md).
|
||||
Loading…
Reference in New Issue
Block a user