github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-03 23:55:06 +00:00
Code Issues Projects Releases Wiki Activity

Updated How to Install Falco using Containers and or Orchestration (markdown)

Mark Stemm
2018-04-02 10:52:06 -07:00
parent 6ae76bdeef
commit e6ca94e0f5
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
How-to-Install-Falco-using-Containers-and-or-Orchestration.md

@@ -47,3 +47,9 @@ sysdig-probe-loader
## Container install (K8s)
If you'd like to run falco as a K8s DaemonSet, we have instructions and a sample yaml files [here](https://github.com/draios/falco/tree/dev/examples/k8s-using-daemonset).
## Additional Notes on Running Falco in Containers/K8s
### Growing Memory Usage for Falco Container When Using File Output
If you notice that the memory usage for a container running Falco increases when using file output methods, even when the memory usage of the falco process itself does not increase, it could be due to the buffer page cache being counted against the memory usage of the container. See falco issue https://github.com/draios/falco/issues/338 for a longer discussion, and the underlying K8s bug/feature is discussed in https://github.com/kubernetes/kubernetes/issues/43916. You can safely cap the memory size of the container to a value like 160Mb, at which point the buffer page cache growth will be limited.