Skip to content

Files

docker

Falco Dockerfiles

This directory contains various ways to package Falco as a container and related tools.

Currently Supported Images

Name Directory Description
falcosecurity/falco:latest, falcosecurity/falco:tag, falcosecurity/falco:master docker/falco Distroless image based on the latest released tar.gz of Falco. No tools are included in the image.
falcosecurity/falco:latest-debian, falcosecurity/falco:tag-debian, falcosecurity/falco:master-debian docker/falco-debian Debian-based image. Include some tools (i.e. jq, curl). No driver-building toolchain support.
falcosecurity/falco-driver-loader:latest, falcosecurity/falco-driver-loader:tag, falcosecurity/falco-driver-loader:master docker/driver-loader Based on falcosecurity/falco:x.y.z-debian (see above) plus the driver building toolchain support and falcoctl. This is intended to be used as an installer or an init container when modern eBPF cannot be used.
falcosecurity/falco-driver-loader:latest-buster, falcosecurity/falco-driver-loader:tag-buster, falcosecurity/falco-driver-loader:master-debian docker/driver-loader-buster Similar to falcosecurity/falco-driver-loader (see above) but based on a legacy Debian image (i.e. buster ). Recommended only for old kernel versions.