Choosing a Falco driver

Falco works by taking Linux system call information at runtime, and rebuilding the state of the kernel in memory. The Falco engine depends on a driver in order to consume the raw stream of system call information. Currently the Falco …

Falco 0.25.0 a.k.a. "the summer release"

Today we announce the release of Falco 0.25 🥳 This one is a small release but a very important one!! You can take a look at the set of changes here: 0.25.0 In case you just want to try out the stable Falco 0.25, you can install its packages …

Falco 0.24.0 a.k.a. "the huge release"

After two long months, look who's back! Today we announce the release of Falco 0.24 🥳 You can take a look at the huge set of changes here: 0.24.0 In case you just want to try out the stable Falco 0.24, you can install its packages following …

Detect CVE-2020-8557 using Falco

CVE-2020-8557 The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill …

Extend Falco outputs with falcosidekick

(2021-04-13) edit: update to integrate Falcosidekick-UI use last versions of Falco helm chart which embeds Falcosidekick as dependency By default, Falco has 5 outputs for its events: stdout, file, gRPC, shell and http. As you can see in the …

Falco 0.23.0 a.k.a. "the artifacts scope release"

Another month has passed and Falco continues to grow! Today we announce the release of Falco 0.23 🥳 Wondering why this release is called "The Artifacts Scope" release? Please read more here. You can take a look at the whole set of …

The Scope of Falco

As The Falco Project continues to grow, we are begining to understand the differences in engagement and support for our tooling. Drawing on the history of the now deprecated Kubernetes incubator and the CNCF project maturity levels we began …

Falco 0.22 a.k.a. "the hard fixes release"

Another month has passed and Falco continues to grow! Today we announce the release of Falco 0.22 🥳 You can take a look at the whole set of changes here: 0.22.0 - thanks to Leonardo Grasso for his first ever release! 0.22.1 - hotfix by me …

Falco on Kind with Prometheus and Grafana

Kind is a tool for running local Kubernetes clusters using Docker container "nodes", that may be used for local development or CI. It also offers a convenient and easy way to install Falco in a Kubernetes cluster and play with it …