ROADMAP - Build slim and full Falco container images #776

mfdii · 2019-08-20T18:49:48Z

Signed-off-by: Michael Ducy michael@ducy.org

What type of PR is this?
/kind feature

Any specific area of the project related to this PR?

/area deployment

What this PR does / why we need it:
The current Falco images are quite large (720 MB) and carry lots of build tools that we want to remove from the current image. The build tools are required to compile kernel modules dynamically when the Falco container starts.

Under the new design we wish to remove the build tools and create two image categories:

Init container image for Kernel Module/eBPF probe delivery
- Container for building probe dynamically (current model)
- Container for pulling module via HTTPS
- Container for building & packaging custom kernel modules
- Container(s) shipping prebuilt modules
Falco container image containing the minimum required software
- Minimal Image falcosecurity/falco-minimal - only required executables and libraries (~19.5mb)
- Slim Image falcosecurity/falco-slim - Distribution based image (~224mb)

Other tasks before this PR is complete:

Which issue(s) this PR fixes:

Fixes #532

Does this PR introduce a user-facing change?:

Initial redesign container images to remove build tools and leverage init containers for kernel module delivery.

mfdii · 2019-08-20T19:03:55Z

Note that the Falco application images can be tested by using the falcosecurity/falco-minimal or falcosecurity/falco-slim images. Currently I've only built a falco probe container image for the linuxkit kernel (docker desktop, falcosecurity/probe-linuxkit-4.9.184).

You can test by running the following:

docker run --rm --privileged falcosecurity/probe-linuxkit-4.9.184
docker run --rm -i -t --name falco --privileged -v /var/run/docker.sock:/host/var/run/docker.sock     -v /dev:/host/dev -v /proc:/host/proc:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro falcosecurity/falco-slim:0.17.0

JPLachance

This is a superb start! I'll be happy to test it in K8s v1.11.10 in AWS 🎉

docker/kernel/linuxkit/Dockerfile

poiana · 2019-08-20T19:26:50Z

@JPLachance: changing LGTM is restricted to assignees, and only falcosecurity/falco repo collaborators may be assigned issues.

In response to this:

This is a superb start! I'll be happy to test it in K8s v1.11.10 in AWS 🎉

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

mfdii · 2019-08-26T19:50:11Z

@JPLachance I've pushed the httploader initContainer. This replicates the current method of pulling kernel modules from S3. Look at the updated k8s daemonset to see how to configure.

JPLachance

Good job! We are almost there! 🎉

JPLachance · 2019-08-26T20:34:56Z

integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap-slim.yaml

+          #    value: "https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/"   
+      containers:
+        - name: falco
+          image: falcosecurity/falco-minimal:latest


Do we need to update Falco rules to allow those new images to run with the --privileged flag?

https://github.com/falcosecurity/falco/blob/dev/rules/falco_rules.yaml#L1751

I think yes, but I'm not sure.

Yes, we will need this.

docker/kernel/httploader/httploader/falcoloader/loader.go

JPLachance · 2019-08-26T20:48:46Z

docker/kernel/httploader/httploader/falcoloader/loader.go

+	_p0, err := unix.BytePtrFromString("")
+
+	if _, _, err := unix.Syscall(313, file.Fd(), uintptr(unsafe.Pointer(_p0)), 0); err != 0 {
+		log.Fatalf("Error loading kernel module: %s. The module may already be loaded.", path)


If the kernel module is already loaded for some reason, how does a Falco user fix it? I think we should add a link to some documentation in the log.

One thing that the current probe loader does is remove the loaded module. We could do this as well, with a retry loop and timeout.

fntlnz

Here's an initial review, thanks for working on this @mfdii !

I also think we need a readme on how to use it but didn't know where to commentt this

docker/kernel/httploader/httploader/falcoloader/loader.go

docker/kernel/httploader/httploader/main.go

docker/slim-stable/Dockerfile

docker/slim-dev/Dockerfile

docker/kernel/httploader/httploader/falcoloader/loader.go

docker/kernel/httploader/httploader/main.go

leodido

Some nits

docker/kernel/httploader/Dockerfile

docker/kernel/httploader/httploader/falcoloader/loader.go

docker/slim-dev/Dockerfile

docker/slim-stable/Dockerfile

docker/kernel/httploader/httploader/falcoloader/loader.go

leodido

Another nit

docker/kernel/httploader/httploader/falcoloader/loader.go

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com> Signed-off-by: Lorenzo Fontana <lo@linux.com>

leodido

🎉

poiana · 2019-10-11T15:04:46Z

LGTM label has been added.

Git tree hash: 2851f34f65c67c607edf8be621c502ae5d6732ba

fntlnz · 2019-10-11T15:15:21Z

@mfdii me and @leodido took over to continue this PR.

We moved the httploader tool to falcoctl falcosecurity/falcoctl#21 - now it's falcoctl install probe

The docker image reflects that. It is pushed following the same versioning as falco, so now we have:

falcosecurity/probeloader:latest
falcosecurity/probeloader:0.17.1

Also instead of having a different image repository for every slim and minimal we are using tags.

E.g: for falco 0.18.0 we will have

falcosecurity/falcoctl:0.18.0
falcosecurity/falcoctl:0.18.0-slim
falcosecurity/falcoctl:0.18.0-minimal

And for latest

falcosecurity/falcoctl:latest
falcosecurity/falcoctl:latest-slim
falcosecurity/falcoctl:latest-minimal

Those slim and minimal images will not be pushed for old falco versions, like 0.17.1 but starting from 0.18.0, the milestone attached to this PR.

The Release process is NOT automated and we have a work item on that #726

mfdii · 2019-10-11T16:25:43Z

lgtm

poiana · 2019-10-11T16:25:44Z

@mfdii: you cannot LGTM your own PR.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Co-authored-by: Lorenzo Fontana <lo@linux.com> Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

leodido · 2019-10-11T16:33:13Z

As planned during last meetings we are going to merge this PR.

@mfdii : there are some missing points/goals listed in the PR corpus, what's the planning for those? I propose to open issues to track them, first of all.

poiana · 2019-10-11T16:33:35Z

LGTM label has been added.

Git tree hash: 89fbc0566bfc3da02c532e95f0a01edb3774ba4a

poiana · 2019-10-11T16:34:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fntlnz, kris-nova, leodido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [fntlnz,kris-nova,leodido]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

poiana added release-note do-not-merge/work-in-progress kind/feature dco-signoff: yes labels Aug 20, 2019

poiana requested review from fntlnz and mstemm August 20, 2019 18:49

poiana added the size/L label Aug 20, 2019

mfdii mentioned this pull request Aug 20, 2019

ROADMAP: Build slim and full Falco container images #532

Closed

16 tasks

JPLachance previously approved these changes Aug 20, 2019

View reviewed changes

docker/kernel/linuxkit/Dockerfile Outdated Show resolved Hide resolved

docker/kernel/linuxkit/Dockerfile Outdated Show resolved Hide resolved

docker/kernel/linuxkit/Dockerfile Outdated Show resolved Hide resolved

leodido self-requested a review August 21, 2019 10:10

leodido added this to the 0.18.0 milestone Aug 22, 2019

mfdii dismissed JPLachance’s stale review via 9d819d6 August 26, 2019 19:43

poiana added size/XL and removed size/L labels Aug 26, 2019

poiana added dco-signoff: no and removed dco-signoff: yes labels Aug 26, 2019

mfdii force-pushed the mfdii/slim-images branch from d952e4b to 12425c3 Compare August 26, 2019 19:53

poiana added dco-signoff: yes and removed dco-signoff: no labels Aug 26, 2019

JPLachance reviewed Aug 26, 2019

View reviewed changes

fntlnz suggested changes Aug 27, 2019

View reviewed changes

poiana assigned fntlnz Aug 27, 2019

fntlnz reviewed Aug 27, 2019

View reviewed changes

docker/kernel/httploader/httploader/main.go Outdated Show resolved Hide resolved

leodido suggested changes Aug 27, 2019

View reviewed changes

poiana assigned leodido Aug 27, 2019

leodido suggested changes Aug 27, 2019

View reviewed changes

docker/kernel/httploader/httploader/falcoloader/loader.go Outdated Show resolved Hide resolved

Issif reviewed Aug 27, 2019

View reviewed changes

docker/kernel/httploader/httploader/falcoloader/loader.go Outdated Show resolved Hide resolved

mfdii force-pushed the mfdii/slim-images branch from e248b25 to d5f8b83 Compare September 5, 2019 13:21

poiana removed the lgtm label Sep 5, 2019

This was referenced Oct 10, 2019

Move the build slim images tool here falcosecurity/falcoctl#20

Closed

falcoctl install probe falcosecurity/falcoctl#21

Merged

fntlnz and others added 5 commits October 11, 2019 16:57

chore: remove http loader code

6b3a11f

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com> Signed-off-by: Lorenzo Fontana <lo@linux.com>

update: httploader now is named probeloader and uses the falcoctl

204264d

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com> Signed-off-by: Lorenzo Fontana <lo@linux.com>

chore(docker/kernel/linuxkit): reformat dockerfile

5e636cd

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com> Signed-off-by: Lorenzo Fontana <lo@linux.com>

chore(docker/minimal): fix typo and set 0.17.1 as base

7ed1845

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com> Signed-off-by: Lorenzo Fontana <lo@linux.com>

docs: reflect the changes to probeloader docker images

f65d719

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com> Signed-off-by: Lorenzo Fontana <lo@linux.com>

poiana added size/XL and removed size/XXL labels Oct 11, 2019

leodido self-requested a review October 11, 2019 15:04

leodido previously approved these changes Oct 11, 2019

View reviewed changes

poiana added the lgtm label Oct 11, 2019

update: refer to latest probeinstaller library in falcoctl/pkg

ed1702b

Co-authored-by: Lorenzo Fontana <lo@linux.com> Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

leodido dismissed their stale review via ed1702b October 11, 2019 16:31

poiana removed the lgtm label Oct 11, 2019

leodido self-requested a review October 11, 2019 16:33

leodido approved these changes Oct 11, 2019

View reviewed changes

poiana added the lgtm label Oct 11, 2019

fntlnz approved these changes Oct 11, 2019

View reviewed changes

leodido merged commit f71c4f0 into dev Oct 11, 2019

poiana deleted the mfdii/slim-images branch October 11, 2019 17:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ROADMAP - Build slim and full Falco container images #776

ROADMAP - Build slim and full Falco container images #776

mfdii commented Aug 20, 2019 •

edited

Loading

mfdii commented Aug 20, 2019

JPLachance left a comment

poiana commented Aug 20, 2019

mfdii commented Aug 26, 2019

JPLachance left a comment

JPLachance Aug 26, 2019

mfdii Aug 28, 2019

JPLachance Aug 26, 2019

mfdii Aug 27, 2019

fntlnz left a comment

leodido left a comment

leodido left a comment •

edited

Loading

leodido left a comment

poiana commented Oct 11, 2019

fntlnz commented Oct 11, 2019

mfdii commented Oct 11, 2019 •

edited

Loading

poiana commented Oct 11, 2019

leodido commented Oct 11, 2019

poiana commented Oct 11, 2019

poiana commented Oct 11, 2019

ROADMAP - Build slim and full Falco container images #776

ROADMAP - Build slim and full Falco container images #776

Conversation

mfdii commented Aug 20, 2019 • edited Loading

mfdii commented Aug 20, 2019

JPLachance left a comment

Choose a reason for hiding this comment

poiana commented Aug 20, 2019

mfdii commented Aug 26, 2019

JPLachance left a comment

Choose a reason for hiding this comment

JPLachance Aug 26, 2019

Choose a reason for hiding this comment

mfdii Aug 28, 2019

Choose a reason for hiding this comment

JPLachance Aug 26, 2019

Choose a reason for hiding this comment

mfdii Aug 27, 2019

Choose a reason for hiding this comment

fntlnz left a comment

Choose a reason for hiding this comment

leodido left a comment

Choose a reason for hiding this comment

leodido left a comment • edited Loading

Choose a reason for hiding this comment

leodido left a comment

Choose a reason for hiding this comment

poiana commented Oct 11, 2019

fntlnz commented Oct 11, 2019

mfdii commented Oct 11, 2019 • edited Loading

poiana commented Oct 11, 2019

leodido commented Oct 11, 2019

poiana commented Oct 11, 2019

poiana commented Oct 11, 2019

mfdii commented Aug 20, 2019 •

edited

Loading

leodido left a comment •

edited

Loading

mfdii commented Oct 11, 2019 •

edited

Loading