github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-22 10:27:00 +00:00
Code Issues Projects Releases Wiki Activity

Updated How to Install Falco using Containers (markdown)

Mark Stemm
2016-08-12 14:44:19 -07:00
parent 68c0fd90ab
commit 735146f7a7
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
How-to-Install-Falco-using-Containers.md

@@ -19,6 +19,13 @@ docker pull sysdig/falco
docker run -i -t --name falco --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro sysdig/falco
```
To see it in action, also run the [event generator](Generating Sample Events):
```
docker pull sysdig/falco-event-generator
docker run -it --name falco-event-generator sysdig/falco-event-generator
```
### Using custom rules with docker container
The falco image has a built-in set of rules located at `/etc/falco_rules.yaml` which is suitable for most purposes. However, you may want to provide your own rules file and still use the falco image. In that case, you should add a volume mapping to map the external rules file to `/etc/falco_rules.yaml` within the container, by adding `-v path-to-falco-rules.yaml:/etc/falco_rules.yaml` to your docker run command.