github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-26 06:42:08 +00:00
Code Issues Projects Releases Wiki Activity
Cloud Native Runtime Security
2,334 Commits 121 Branches 172 Tags 104 MiB
C++ 83.7%
CMake 8.2%
C 3.5%
Shell 3.1%
Dockerfile 1.2%
Other 0.3%
2226a1508c
Go to file
ismail yenigul 2226a1508c exception to privileged container for EKS images 
Signed-off-by: ismail yenigul <ismailyenigul@gmail.com>
2021-05-06 02:36:48 +02:00
.circleci ci: add missing infra context to publish stable Falco packages 2021-04-12 16:45:32 +02:00
.github update(.github): remove stale bot in favor of lifecycle bot (prowjobs) 2020-11-23 11:24:12 -05:00
audits move audit doc 2019-12-17 09:15:41 +01:00
brand docs(brand): documenting Falco color scheme 2020-09-28 15:15:36 +02:00
cmake Bump year to 2021 2021-03-12 10:45:31 +01:00
docker update(docker/falco): SKIP_MODULE_LOAD not supported anymore - use SKIP_DRIVER_LOADER 2021-04-08 20:40:39 +02:00
proposals new(proposals): libraries donation 2021-02-04 17:29:42 +01:00
rules exception to privileged container for EKS images 2021-05-06 02:36:48 +02:00
scripts chore(scripts): restore mount of debugfs (notes below) 2021-04-08 20:40:39 +02:00
test new(test): regression test for FAL-01-003 2021-04-21 15:11:17 +02:00
tests build: remove civetweb when minimal build 2020-09-10 15:01:07 +02:00
userspace update(userspace/falco): handle the case there wasn't been any previously processed event 2021-04-19 16:56:53 +02:00
.clang-format chore: clang format following the current style 2019-07-03 09:07:00 +02:00
.cmake-format new: cmake format colums to 120 2020-01-17 19:09:31 +01:00
.gitignore Remove falco_tests.yaml from gitignore 2021-01-19 10:37:55 +01:00
.luacheckrc chore: clean up lua from dot files 2020-10-13 05:12:00 -04:00
.yamllint.conf new: YAML lint configuration 2019-07-10 13:00:03 +02:00
ADOPTERS.md Add Secureworks to adopters 2021-04-26 10:34:00 +02:00
CHANGELOG.md docs: update CHANGELOG 2021-04-12 16:45:32 +02:00
CMakeLists.txt build: enable ASLR for statically linked build 2021-04-22 18:12:05 +02:00
COPYING docs: update COPYING 2019-10-08 16:02:26 +02:00
falco.yaml update(userspace/falco): print out current time when a timeouts notification gets emitted 2021-04-19 16:56:53 +02:00
OWNERS docs: add myself to owners 2020-07-03 16:37:17 +02:00
README.md chore(README): correct comments 2021-04-07 16:45:50 +02:00
RELEASE.md urelease/docs: fix link and small refactor in the text 2021-04-30 14:27:26 +02:00

README.md

Cloud Native Runtime Security.

Build Status CII Best Practices Summary GitHub

Want to talk? Join us on the #falco channel in the Kubernetes Slack.

Latest releases

Read the change log.

development stable
rpm rpm-dev rpm
deb deb-dev deb
binary bin-dev bin

The Falco Project, originally created by Sysdig, is an incubating CNCF open source cloud native runtime security tool. Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. Falco has a rich set of security rules specifically built for Kubernetes, Linux, and cloud-native. If a rule is violated in a system, Falco will send an alert notifying the user of the violation and its severity.

Installing Falco

If you would like to run Falco in production please adhere to the official installation guide.

Kubernetes
Tool Link Note
Helm Chart Repository The Falco community offers regular helm chart releases.
Minikube Tutorial The Falco driver has been baked into minikube for easy deployment.
Kind Tutorial Running Falco with kind requires a driver on the host system.
GKE Tutorial We suggest using the eBPF driver for running Falco on GKE.

Developing

Falco is designed to be extensible such that it can be built into cloud-native applications and infrastructure.

Falco has a gRPC endpoint and an API defined in protobuf. The Falco Project supports various SDKs for this endpoint.

SDKs
Language Repository
Go client-go
Rust client-rs
Python client-py

What can Falco detect?

Falco can detect and alert on any behavior that involves making Linux system calls. Falco alerts can be triggered by the use of specific system calls, their arguments, and by properties of the calling process. For example, Falco can easily detect incidents including but not limited to:

  • A shell is running inside a container or pod in Kubernetes.
  • A container is running in privileged mode, or is mounting a sensitive path, such as /proc, from the host.
  • A server process is spawning a child process of an unexpected type.
  • Unexpected read of a sensitive file, such as /etc/shadow.
  • A non-device file is written to /dev.
  • A standard system binary, such as ls, is making an outbound network connection.
  • A privileged pod is started in a Kubernetes cluster.

Documentation

The Official Documentation is the best resource to learn about Falco.

Join the Community

To get involved with The Falco Project please visit the community repository to find more.

How to reach out?

Contributing

See the CONTRIBUTING.md.

Security Audit

A third party security audit was performed by Cure53, you can see the full report here.

Reporting security vulnerabilities

Please report security vulnerabilities following the community process documented here.

License Terms

Falco is licensed to you under the Apache 2.0 open source license.