diff --git a/How-to-Install-Falco-from-Source.md b/How-to-Install-Falco-from-Source.md index 3e0b4b6..bb6010f 100644 --- a/How-to-Install-Falco-from-Source.md +++ b/How-to-Install-Falco-from-Source.md @@ -2,7 +2,33 @@ Building falco requires having `cmake` and `g++` installed. -## Check out source code +## Build using docker-builder container + +One easy way to build falco is to run the [falco-builder](https://hub.docker.com/r/falcosecurity/falco/). It contains the reference toolchain we use to build packages. + +The image depends on the following parameters: + +* `FALCO_VERSION`: the version to give any built packages +* `BUILD_TYPE`: Debug or Release +* `BUILD_DRIVER`: whether or not to build the kernel module when +building. This should usually be OFF, as the kernel module would be +built for the files in the centos image, not the host. +* `BUILD_BPF: Like `BUILD_DRIVER` but for the ebpf program. +* `BUILD_WARNINGS_AS_ERRORS`: consider all build warnings fatal +* `MAKE_JOBS`: passed to the -j argument of make + +A typical way to run this builder is the following. Assumes you have +checked out falco and sysdig to directories below /home/user/src, and +want to use a build directory of /home/user/build/falco: + +``` +$ docker run --user $(id -u):$(id -g) -v /etc/passwd:/etc/passwd:ro -e MAKE_JOBS=4 -it -v /home/user/src:/source -v /home/user/build/falco:/build falco-builder cmake +$ docker run --user $(id -u):$(id -g) -v /etc/passwd:/etc/passwd:ro -e MAKE_JOBS=4 -it -v /home/user/src:/source -v /home/user/build/falco:/build falcosecurity/falco-builder package +``` + +## Build directly on host + +If you'd rather build directly on the host, you can use your local toolchain and cmake binaries. Clone this repo in a directory that also contains the sysdig source repo. The result should be something like: