falco/docker

Falco Dockerfiles

This directory contains various ways to package Falco as a container and related tools.

Currently Supported Images

Name	Directory	Description
falcosecurity/falco:latest, falcosecurity/falco:tag, falcosecurity/falco:master	docker/falco	Distroless image based on the latest released tar.gz of Falco. No tools are included in the image.
falcosecurity/falco:latest-debian, falcosecurity/falco:tag-debian, falcosecurity/falco:master-debian	docker/falco-debian	Debian-based image. Include some tools (i.e. jq, curl). No driver-building toolchain support.
falcosecurity/falco-driver-loader:latest, falcosecurity/falco-driver-loader:tag, falcosecurity/falco-driver-loader:master	docker/driver-loader	Based on falcosecurity/falco:x.y.z-debian (see above) plus the driver building toolchain support and falcoctl. This is intended to be used as an installer or an init container when modern eBPF cannot be used.
falcosecurity/falco-driver-loader:latest-buster, falcosecurity/falco-driver-loader:tag-buster, falcosecurity/falco-driver-loader:master-debian	docker/driver-loader-buster	Similar to falcosecurity/falco-driver-loader (see above) but based on a legacy Debian image (i.e. buster ). Recommended only for old kernel versions.