Falco in 2020

The scope of this post is to review the progress of Falco and its community during the pandemic year. A year will never forget. I will try to keep it compact, but Falco, and its community, grown so much this year that I feel like this could …

Security boundaries with Kubernetes and systemd

A familiar scenario Imagine installing a security tool that requires privileged access using the Kubernetes API. Now imagine our cluster is compromised. As an attacker, the first thing I would do would be to ensure that whatever security …

Falco 0.26.2 a.k.a. "the download.falco.org release"

Today we announce the release of Falco 0.26.2 🥳 This one is a hotfix release for the Falco 0.26.1 released on October 1st. You can take a look at the set of changes here: 0.26.2 As usual, in case you just want to try out the stable Falco …

Falco 0.26.1 a.k.a. "the static release"

Today we announce the release of Falco 0.26.1 🥳 This one is a hotfix release for the Falco 0.26.0 released last week! You can take a look at the set of changes here: 0.26.1 0.26.0 As usual, in case you just want to try out the stable Falco …

Choosing a Falco driver

Falco works by taking Linux system call information at runtime, and rebuilding the state of the kernel in memory. The Falco engine depends on a driver in order to consume the raw stream of system call information. Currently the Falco …

Falco 0.25.0 a.k.a. "the summer release"

Today we announce the release of Falco 0.25 🥳 This one is a small release but a very important one!! You can take a look at the set of changes here: 0.25.0 In case you just want to try out the stable Falco 0.25, you can install its packages …

Falco 0.24.0 a.k.a. "the huge release"

After two long months, look who's back! Today we announce the release of Falco 0.24 🥳 You can take a look at the huge set of changes here: 0.24.0 In case you just want to try out the stable Falco 0.24, you can install its packages following …

Detect CVE-2020-8557 using Falco

CVE-2020-8557 The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill …

Extend Falco outputs with falcosidekick

(2021-04-13) edit: update to integrate Falcosidekick-UI use last versions of Falco helm chart which embeds Falcosidekick as dependency By default, Falco has 5 outputs for its events: stdout, file, gRPC, shell and http. As you can see in the …