mirror of
https://github.com/falcosecurity/falco.git
synced 2026-05-12 17:52:56 +00:00
4a941df787
Simple docker-compose environment that starts a simple express server with a poorly-designed /api/exec/<cmd> endpoint that executes arbitrary commands, and uses falco to detect running bash.
25 lines
631 B
YAML
25 lines
631 B
YAML
# Owned by software vendor, serving install-software.sh.
|
|
express_server:
|
|
container_name: express_server
|
|
image: node:latest
|
|
working_dir: /usr/src/app
|
|
command: bash -c "npm install && node server.js"
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- ${PWD}:/usr/src/app
|
|
|
|
falco:
|
|
container_name: falco
|
|
image: sysdig/falco:latest
|
|
privileged: true
|
|
volumes:
|
|
- /var/run/docker.sock:/host/var/run/docker.sock
|
|
- /dev:/host/dev
|
|
- /proc:/host/proc:ro
|
|
- /boot:/host/boot:ro
|
|
- /lib/modules:/host/lib/modules:ro
|
|
- /usr:/host/usr:ro
|
|
- ${PWD}/../../rules/falco_rules.yaml:/etc/falco_rules.yaml
|
|
tty: true
|