ROADMAP - Build slim and full Falco container images

docker/README.md

@@ -0,0 +1,30 @@
+# Falco Dockerfiles
+
+This directory contains the various ways to package Falco as a container. 
+
+## Currently Supported Containers
+
+### `falcosecurity/falco` Dockerfiles
+ - `./dev`: Builds a container image from the `dev` apt repo.
+ - `./stable`: Builds a container image from the `stable` apt repo.
+ - `./local`: Builds a container image from a locally provided Falco `dpkg` package.
+
+### Build & Testing Dockerfiles
+ - `./builder`: `falcosecurity/falco-builder` - The complete build tool chain for compiling Falco from source. See [the documentation](https://falco.org/docs/source/) for more details on building from source.
+ - `./tester`: `falcosecurity/falco-tester` - Container image for running the Falco test suite.
+
+## Alpha Release Containers
+
+These Dockerfiles (and resulting container images) are currently in `alpha`. We'd love for you to test these images and [report any feedback](https://github.com/falcosecurity/falco/issues/new/choose).
+
+### Slim and Minimal Dockerfiles
+The goal of these container images is to reduce the size of the underlying Falco container. 
+ - `./slim-dev`: Like `./dev` above but removes build tools for older kernels.
+ - `./slim-stable`: Like `./stable` above but removes build tools for older kernels.
+ - `./minimal`: A minimal container image (~20mb), containing only the files required to run Falco.
+
+### Init Containers
+These container images allow for the delivery of the kernel module or eBPF probe either via HTTP or via a container image.
+ - `kernel/linuxkit`: Multistage Dockerfile to build a Falco kernel module for Linuxkit (Docker Desktop). Generates an alpine based container image with the kernel module, and `insmod` as the container `CMD`.  
+ - `kernel/probeloader`: Multistage Dockerfile to build a Go based application to download (via HTTPS) and load a Falco kernel module. The resulting container image can be ran as an `initContainer` to load the Falco module before Falco starts.
+

docker/dev/Dockerfile

@@ -1,6 +1,6 @@
 FROM debian:unstable
 
-LABEL maintainer="Sysdig <support@sysdig.com>"
+LABEL maintainer="opensource@sysdig.com"
 
 ENV FALCO_REPOSITORY dev
 

docker/event-generator/Dockerfile

@@ -1,4 +1,5 @@
 FROM alpine:latest
+LABEL maintainer="opensource@sysdig.com"
 RUN apk add --no-cache bash g++
 COPY ./event_generator.cpp /usr/local/bin
 RUN mkdir -p /var/lib/rpm

docker/kernel/linuxkit/Dockerfile

@@ -0,0 +1,38 @@
+ARG ALPINE_VERSION=3.10
+ARG KERNEL_VERSION=4.9.184
+ARG FALCO_VERSION=0.17.0
+
+FROM linuxkit/kernel:${KERNEL_VERSION} AS ksrc
+FROM falcosecurity/falco-minimal:${FALCO_VERSION} as falco
+FROM alpine:${ALPINE_VERSION} AS probe-build
+LABEL maintainer="opensource@sysdig.com"
+ARG KERNEL_VERSION=4.9.184
+ARG FALCO_VERSION=0.17.0
+ENV FALCO_VERSION=${FALCO_VERSION}
+ENV KERNEL_VERSION=${KERNEL_VERSION}
+
+COPY --from=ksrc /kernel-dev.tar /
+COPY --from=falco /usr/src/falco-${FALCO_VERSION} /usr/src/falco-${FALCO_VERSION}
+
+RUN apk add --no-cache --update \
+  build-base gcc abuild binutils \
+  bc \
+  autoconf && \
+  export KERNELVER=`uname -r  | cut -d '-' -f 1`  && \
+  export KERNELDIR=/usr/src/linux-headers-${KERNEL_VERSION}-linuxkit/ && \
+  tar xf /kernel-dev.tar && \
+  cd $KERNELDIR && \
+  zcat /proc/1/root/proc/config.gz > .config && \
+  make olddefconfig && \
+  cd /usr/src/falco-${FALCO_VERSION} && \
+  make && \
+  apk del \
+  build-base gcc abuild binutils \
+  bc \
+  autoconf
+
+FROM alpine:${ALPINE_VERSION}
+ARG FALCO_VERSION=0.17.0
+ENV FALCO_VERSION=${FALCO_VERSION}
+COPY --from=probe-build /usr/src/falco-${FALCO_VERSION}/falco-probe.ko /
+CMD ["insmod","/falco-probe.ko"] 

docker/kernel/probeloader/Dockerfile

@@ -0,0 +1,18 @@
+FROM golang:1.13-alpine AS build
+ARG FALCOCTL_REF=2be3df92edbac668284fe5c165ccb5bd6bf4e869
+
+RUN apk --no-cache add build-base git gcc ca-certificates
+
+RUN git clone https://github.com/falcosecurity/falcoctl.git /falcoctl
+
+WORKDIR /falcoctl
+
+RUN git checkout ${FALCOCTL_REF}
+RUN go mod vendor
+RUN CGO_ENABLED=0 GOOS=linux go build -a -o falcoctl -ldflags '-extldflags "-static"' .
+
+FROM scratch
+LABEL maintainer="opensource@sysdig.com"
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build /falcoctl/falcoctl /falcoctl
+CMD ["/falcoctl", "install", "probe"]

docker/minimal/Dockerfile

@@ -0,0 +1,50 @@
+FROM ubuntu:18.04 as ubuntu
+
+LABEL maintainer="opensource@sysdig.com"
+
+ARG FALCO_VERSION=0.17.1
+
+ENV FALCO_VERSION=${FALCO_VERSION}
+
+WORKDIR /
+
+ADD https://s3.amazonaws.com/download.draios.com/stable/tgz/x86_64/falco-${FALCO_VERSION}-x86_64.tar.gz /
+
+# ADD will download from URL and unntar
+RUN apt-get update && \
+    apt-get install -y  binutils && \
+    # curl -O https://s3.amazonaws.com/download.draios.com/stable/tgz/x86_64/falco-${FALCO_VERSION}-x86_64.tar.gz && \
+    tar xfzv falco-${FALCO_VERSION}-x86_64.tar.gz && \
+    rm -f falco-${FALCO_VERSION}-x86_64.tar.gz && \
+    mv falco-${FALCO_VERSION}-x86_64 falco && \
+    strip falco/usr/bin/falco && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+FROM scratch
+
+COPY --from=ubuntu /lib/x86_64-linux-gnu/libanl.so.1 \
+    /lib/x86_64-linux-gnu/libc.so.6 /lib/x86_64-linux-gnu/libdl.so.2 \
+    /lib/x86_64-linux-gnu/libgcc_s.so.1 /lib/x86_64-linux-gnu/libm.so.6 \
+    /lib/x86_64-linux-gnu/libnsl.so.1 /lib/x86_64-linux-gnu/libnss_compat.so.2 \
+    /lib/x86_64-linux-gnu/libnss_files.so.2 /lib/x86_64-linux-gnu/libnss_nis.so.2 \
+    /lib/x86_64-linux-gnu/libpthread.so.0 /lib/x86_64-linux-gnu/librt.so.1 \
+    /lib/x86_64-linux-gnu/libz.so.1 \
+    /lib/x86_64-linux-gnu/ 
+
+COPY --from=ubuntu /usr/lib/x86_64-linux-gnu/libstdc++.so.6 \
+    /usr/lib/x86_64-linux-gnu/libstdc++.so.6
+
+COPY --from=ubuntu /etc/ld.so.cache \
+    /etc/nsswitch.conf \
+    /etc/ld.so.cache \
+    /etc/passwd \
+    /etc/group \
+    /etc/
+
+COPY --from=ubuntu /etc/default/nss /etc/default/nss
+COPY --from=ubuntu /lib64/ld-linux-x86-64.so.2 /lib64/ld-linux-x86-64.so.2
+
+COPY --from=ubuntu /falco /
+
+CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]

docker/slim-dev/Dockerfile

@@ -0,0 +1,50 @@
+FROM ubuntu:18.04
+
+LABEL maintainer="opensource@sysdig.com"
+
+ENV FALCO_REPOSITORY dev
+
+LABEL RUN="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
+
+ENV SYSDIG_HOST_ROOT /host
+
+ENV HOME /root
+
+RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
+
+ADD http://download.draios.com/apt-draios-priority /etc/apt/preferences.d/
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+# 	bash-completion \
+# 	bc \
+ 	ca-certificates \
+ 	curl \
+ 	gnupg2 \
+ 	jq \
+# 	netcat \
+# 	xz-utils \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN curl -s https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public | apt-key add - \
+  && curl -s -o /etc/apt/sources.list.d/draios.list http://download.draios.com/$FALCO_REPOSITORY/deb/draios.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends falco \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# Change the falco config within the container to enable ISO 8601
+# output.
+RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
+ && mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
+
+# Some base images have an empty /lib/modules by default
+# If it's not empty, docker build will fail instead of
+# silently overwriting the existing directory
+RUN rm -df /lib/modules \
+ && ln -s $SYSDIG_HOST_ROOT/lib/modules /lib/modules
+
+#COPY ./entrypoint.sh /
+# ENTRYPOINT ["/entrypoint.sh"]
+
+CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]

docker/slim-stable/Dockerfile

@@ -0,0 +1,50 @@
+FROM ubuntu:18.04
+
+LABEL maintainer="opensource@sysdig.com"
+
+ENV FALCO_REPOSITORY stable
+
+LABEL RUN="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"
+
+ENV SYSDIG_HOST_ROOT /host
+
+ENV HOME /root
+
+RUN cp /etc/skel/.bashrc /root && cp /etc/skel/.profile /root
+
+ADD http://download.draios.com/apt-draios-priority /etc/apt/preferences.d/
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+# 	bash-completion \
+# 	bc \
+ 	ca-certificates \
+ 	curl \
+ 	gnupg2 \
+ 	jq \
+# 	netcat \
+# 	xz-utils \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN curl -s https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public | apt-key add - \
+  && curl -s -o /etc/apt/sources.list.d/draios.list http://download.draios.com/$FALCO_REPOSITORY/deb/draios.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends falco \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# Change the falco config within the container to enable ISO 8601
+# output.
+RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/falco/falco.yaml > /etc/falco/falco.yaml.new \
+ && mv /etc/falco/falco.yaml.new /etc/falco/falco.yaml
+
+# Some base images have an empty /lib/modules by default
+# If it's not empty, docker build will fail instead of
+# silently overwriting the existing directory
+RUN rm -df /lib/modules \
+ && ln -s $SYSDIG_HOST_ROOT/lib/modules /lib/modules
+
+#COPY ./entrypoint.sh /
+# ENTRYPOINT ["/entrypoint.sh"]
+
+CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]

docker/stable/Dockerfile

@@ -1,6 +1,6 @@
 FROM debian:unstable
 
-LABEL maintainer="Sysdig <support@sysdig.com>"
+LABEL maintainer="opensource@sysdig.com"
 
 ENV FALCO_REPOSITORY stable
 

integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap-slim.yaml

@@ -0,0 +1,96 @@
+apiVersion: extensions/v1beta1
+kind: DaemonSet
+metadata:
+  name: falco-daemonset
+  labels:
+    app: falco-example
+    role: security
+spec:
+  template:
+    metadata:
+      labels:
+        app: falco-example
+        role: security
+    spec:
+      serviceAccount: falco-account
+      initContainers:
+        - name: probeloader
+          image: falcosecurity/probeloader:latest
+          securityContext:
+            privileged: true
+          #env:
+          #  - name: FALCOCTL_FALCO_VERSION
+          #    value: 0.17.0
+          #  - name: FALCOCTL_FALCO_PROBE_URL
+          #    value:
+          #  - name: FALCOCTL_FALCO_PROBE_REPO
+          #    value: "https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/"
+          volumeMounts:
+            - mountPath: /host/boot
+              name: boot-fs
+              readOnly: true
+      containers:
+        - name: falco
+          image: falcosecurity/falco:0.17.1-slim
+          securityContext:
+            privileged: true
+# Uncomment the 3 lines below to enable eBPF support for Falco.
+# This allows Falco to run on Google COS.
+# Leave blank for the default probe location, or set to the path
+# of a precompiled probe.
+#          env:
+#          - name: SYSDIG_BPF_PROBE
+#            value: ""
+          args: [ "/usr/bin/falco", "--cri", "/host/run/containerd/containerd.sock", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://$(KUBERNETES_SERVICE_HOST)", "-pk"]
+          volumeMounts:
+            - mountPath: /host/var/run/docker.sock
+              name: docker-socket
+            - mountPath: /host/run/containerd/containerd.sock
+              name: containerd-socket
+            - mountPath: /host/dev
+              name: dev-fs
+            - mountPath: /host/proc
+              name: proc-fs
+              readOnly: true
+            - mountPath: /host/boot
+              name: boot-fs
+              readOnly: true
+            - mountPath: /host/lib/modules
+              name: lib-modules
+              readOnly: true
+            - mountPath: /host/usr
+              name: usr-fs
+              readOnly: true
+            - mountPath: /host/etc/
+              name: etc-fs
+              readOnly: true
+            - mountPath: /etc/falco
+              name: falco-config
+      volumes:
+        - name: docker-socket
+          hostPath:
+            path: /var/run/docker.sock
+        - name: containerd-socket
+          hostPath:
+            path: /run/containerd/containerd.sock
+        - name: dev-fs
+          hostPath:
+            path: /dev
+        - name: proc-fs
+          hostPath:
+            path: /proc
+        - name: boot-fs
+          hostPath:
+            path: /boot
+        - name: lib-modules
+          hostPath:
+            path: /lib/modules
+        - name: usr-fs
+          hostPath:
+            path: /usr
+        - name: etc-fs
+          hostPath:
+            path: /etc
+        - name: falco-config
+          configMap:
+            name: falco-config