Falco: runtime security for Linux and Kubernetes

Falco (about 9,500 stars on GitHub) is an open source runtime security tool for Linux, containers and Kubernetes. It was created in 2016 by Sysdig and donated to the Cloud Native Computing Foundation (CNCF) in 2018, where it became a graduated project in 2024, the foundation’s highest maturity level. Written in C++, it is one of the few security tools designed from the start for container workloads rather than adapted to them.

What it does

Falco sits at the kernel level. Using an eBPF probe or a kernel module it observes every system call made by every process on the host, including processes inside containers, and enriches each event with container and Kubernetes metadata such as the pod name and namespace. A rule engine then compares the stream against a set of rules that describe unexpected behaviour: a shell spawned in a container, a process writing below /etc, an outbound connection from a database pod, a binary executed from a temporary directory. When a rule matches, Falco emits an alert to standard output, a file, syslog, a webhook or, through the companion Falcosidekick project, to dozens of destinations including Slack, Elasticsearch and Loki. Falco detects and reports; it does not block by itself, although response actions can be built on top with the Falco Talon project.

Why it matters for Kubernetes

Traditional host intrusion detection does not understand that one machine runs many short lived containers from different images and teams. Falco’s rules can say “a shell in a container is suspicious” without caring which host the container landed on, and its alerts carry the pod, image and namespace an analyst needs. Deployed as a DaemonSet it covers every node in a cluster automatically.

How to install it

Packages exist for Debian, Ubuntu and Red Hat based distributions, and there is an official Helm chart for Kubernetes. On a single Linux host the package route is enough to see the default rules fire:

curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg
sudo apt install falco
sudo falco --version

On Kubernetes the chart from falcosecurity/charts installs Falco on every node with the modern eBPF driver, which needs no kernel headers. The documentation describes rule syntax, outputs and tuning to reduce noise.

Credit

Falco was created at Sysdig and is maintained by the Falco maintainers and the wider CNCF community, with contributors from Sysdig, IBM, Red Hat and others. It is licensed under the Apache License 2.0.