falco docker containers monitoring

Question

Can any one of you please tell me where I can find the way to monitor docker images with falco? Now I'm using Ubuntu for testing purposes, but in the end I want to use it in AWS Fargate environment.

Thanks

Help on this from the community

Answer 1

Quoting from Falco docs:

To run Falco in a container using Docker with full privileges use the following commands. If you want to use Falco with the Kernel module driver:

docker pull falcosecurity/falco:latest

docker run --rm -i -t \
    --privileged \
    -v /var/run/docker.sock:/host/var/run/docker.sock \
    -v /dev:/host/dev \
    -v /proc:/host/proc:ro \
    -v /boot:/host/boot:ro \
    -v /lib/modules:/host/lib/modules:ro \
    -v /usr:/host/usr:ro \
    -v /etc:/host/etc:ro \
    falcosecurity/falco:latest