mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 03:49:36 +00:00
e4ffa55d58
* Fix spec name * Add a playbook for capturing stuff using sysdig in a container * Add event-name to job name for avoid collisions among captures * Implement job for starting container in Pod in Kubernetes Client We are going to pick data for all Pod, not limited to one container * Use sysdig/capturer image for capture and upload to s3 the capture * There is a bug with environment string splitting in kubeless https://github.com/kubeless/kubeless/issues/824 So here is a workaround which uses multiple --env flags, one for each environment. * Use shorter job name. Kubernetes limit is 64 characters. * Add a deployable playbook with Kubeless for capturing stuff with Sysdig * Document the integration with Sysdig capture * Add Dockerfile for creating sysdig-capturer
25 lines
1.2 KiB
Docker
25 lines
1.2 KiB
Docker
FROM sysdig/sysdig:latest
|
|
|
|
MAINTAINER Néstor Salceda <nestor.salceda@sysdig.com>
|
|
|
|
RUN apt-get update \
|
|
&& apt-get --fix-broken install -y \
|
|
&& apt-get install -y --no-install-recommends \
|
|
s3cmd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# debian:unstable head contains binutils 2.31, which generates
|
|
# binaries that are incompatible with kernels < 4.16. So manually
|
|
# forcibly install binutils 2.30-22 instead.
|
|
RUN curl -s -o binutils_2.30-22_amd64.deb http://snapshot.debian.org/archive/debian/20180622T211149Z/pool/main/b/binutils/binutils_2.30-22_amd64.deb \
|
|
&& curl -s -o libbinutils_2.30-22_amd64.deb http://snapshot.debian.org/archive/debian/20180622T211149Z/pool/main/b/binutils/libbinutils_2.30-22_amd64.deb \
|
|
&& curl -s -o binutils-x86-64-linux-gnu_2.30-22_amd64.deb http://snapshot.debian.org/archive/debian/20180622T211149Z/pool/main/b/binutils/binutils-x86-64-linux-gnu_2.30-22_amd64.deb \
|
|
&& curl -s -o binutils-common_2.30-22_amd64.deb http://snapshot.debian.org/archive/debian/20180622T211149Z/pool/main/b/binutils/binutils-common_2.30-22_amd64.deb \
|
|
&& dpkg -i *binutils*.deb
|
|
|
|
ENV CAPTURE_DURATION 120
|
|
|
|
COPY ./docker-entrypoint.sh /
|
|
|
|
ENTRYPOINT ["/docker-entrypoint.sh"]
|