mirror of
https://github.com/falcosecurity/falco.git
synced 2026-03-20 03:32:09 +00:00
2e7a0b026f
To supoprt the use of outputs that are documented in the falco examples (e.g. jq piped to curl) I would like to propose including these tools in the falco-no-driver image. They add a very minimal size and dependency to the image but would make things a lot easier for users getting started. Closes #2580 Signed-off-by: Daniel Wright <danielwright@bitgo.com>
40 lines
1.4 KiB
Docker
40 lines
1.4 KiB
Docker
FROM ubuntu:18.04 as ubuntu
|
|
|
|
ARG FALCO_VERSION
|
|
ARG VERSION_BUCKET=bin
|
|
|
|
ENV FALCO_VERSION=${FALCO_VERSION}
|
|
ENV VERSION_BUCKET=${VERSION_BUCKET}
|
|
|
|
RUN apt-get -y update && apt-get -y install gridsite-clients curl ca-certificates
|
|
|
|
WORKDIR /
|
|
|
|
RUN curl -L -o falco.tar.gz \
|
|
https://download.falco.org/packages/${VERSION_BUCKET}/$(uname -m)/falco-$(urlencode ${FALCO_VERSION})-$(uname -m).tar.gz && \
|
|
tar -xvf falco.tar.gz && \
|
|
rm -f falco.tar.gz && \
|
|
mv falco-${FALCO_VERSION}-$(uname -m) falco && \
|
|
rm -rf /falco/usr/src/falco-* /falco/usr/bin/falco-driver-loader
|
|
|
|
RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /falco/etc/falco/falco.yaml > /falco/etc/falco/falco.yaml.new \
|
|
&& mv /falco/etc/falco/falco.yaml.new /falco/etc/falco/falco.yaml
|
|
|
|
FROM debian:11-slim
|
|
|
|
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
|
LABEL org.opencontainers.image.source="https://github.com/falcosecurity/falco"
|
|
|
|
LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro --name NAME IMAGE"
|
|
# NOTE: for the "least privileged" use case, please refer to the official documentation
|
|
|
|
RUN apt-get -y update && apt-get -y install ca-certificates curl jq \
|
|
&& apt clean -y && rm -rf /var/lib/apt/lists/*
|
|
|
|
ENV HOST_ROOT /host
|
|
ENV HOME /root
|
|
|
|
COPY --from=ubuntu /falco /
|
|
|
|
CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]
|