falco/docker

Falco Dockerfiles

This directory contains various ways to package Falco as a container and related tools.

Currently Supported Images

Name	Directory	Description
falcosecurity/falco:latest, falcosecurity/falco:tag, falcosecurity/falco:master	docker/falco	Distroless image without driver building toolchain support, based on the latest released tar.gz of Falco. No tools or falcoctl not included.
falcosecurity/falco:latest-debian, falcosecurity/falco:tag-debian, falcosecurity/falco:master-debian	docker/falco-debian	Debian-based image without driver building toolchain support, based on the latest released Deb of Falco (similar to the old falcosecurity/falco-no-driver image). May include some tools (ie. jq, curl), but not falcoctl.
falcosecurity/falco-driver-loader:latest, falcosecurity/falco-driver-loader:tag, falcosecurity/falco-driver-loader:master	docker/driver-loader	Based on falcosecurity/falco:x.y.z-debian (see above) plus the driver building toolchain support and also shipping the latest version of falcoctl. Recommended only when modern eBPF is not supported.
falcosecurity/falco-driver-loader:latest-buster, falcosecurity/falco-driver-loader:tag-buster, falcosecurity/falco-driver-loader:master-debian	docker/driver-loader-buster	Similar to falcosecurity/falco-driver-loader (see above) but based on a legacy Debian image (i.e. buster ). Recommended only for old kernel versions.