From 735146f7a7ef7d65db1f9319004975d7d150273e Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Fri, 12 Aug 2016 14:44:19 -0700 Subject: [PATCH] Updated How to Install Falco using Containers (markdown) --- How-to-Install-Falco-using-Containers.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/How-to-Install-Falco-using-Containers.md b/How-to-Install-Falco-using-Containers.md index 944be92..16b2833 100644 --- a/How-to-Install-Falco-using-Containers.md +++ b/How-to-Install-Falco-using-Containers.md @@ -19,6 +19,13 @@ docker pull sysdig/falco docker run -i -t --name falco --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro sysdig/falco ``` +To see it in action, also run the [event generator](Generating Sample Events): + +``` +docker pull sysdig/falco-event-generator +docker run -it --name falco-event-generator sysdig/falco-event-generator +``` + ### Using custom rules with docker container The falco image has a built-in set of rules located at `/etc/falco_rules.yaml` which is suitable for most purposes. However, you may want to provide your own rules file and still use the falco image. In that case, you should add a volume mapping to map the external rules file to `/etc/falco_rules.yaml` within the container, by adding `-v path-to-falco-rules.yaml:/etc/falco_rules.yaml` to your docker run command.