Container Runtime Protection

This chapter looks at installing Falco and explores its features and how it can help secure our container runtime and underlying hosts, in the same way that some commercial products do, but without any associated fees. Falco works by tapping into the kernel with elevated permissions to pick up the kernel's system calls, and the driver is needed to offer that required functionality. The Berkeley Packet Filter has been extended to allow increased access to the networking stack to applications via the kernel. Relinquishing an undefined security control, such as having a common attack vector across all hosts, to on board a security tool to protect running containers is a necessary evil. The chapter explains how Falco's rulesets are constructed. Falco also employs the concept of using macros.