xTag

Overview

Full name
docker.io/falcosecurity/falco
Registry
docker.io
Namespace
falcosecurity
Repository
falco
Cached tags
415
Last synced
07/05/2026, 04:54 PM

Introduction

Falco 云原生运行时安全镜像，内核 eBPF/规则引擎检测容器异常行为，K8s 入侵检测与合规审计安全侧车。

Details

falcosecurity/falco 运行 CNCF Falco 运行时威胁检测引擎，通过 syscall/eBPF 监控容器内可疑行为并输出告警。定位为节点级安全守护进程，需 privileged 或 eBPF 权限挂载宿主机 /proc；K8s 集群入侵检测、挖矿/反弹 shell 发现或 PCI-DSS 运行时审计，非普通业务应用。

快速启动

docker run -d --name falco \
  --privileged \
  -v /var/run/docker.sock:/host/var/run/docker.sock \
  -v /dev:/host/dev \
  -v /proc:/host/proc:ro \
  docker.io/falcosecurity/falco:latest

推荐实践

docker run -d --name falco \
  --privileged \
  --restart unless-stopped \
  -v /var/run/docker.sock:/host/var/run/docker.sock \
  -v /etc/falco/falco_rules.yaml:/etc/falco/falco_rules.yaml:ro \
  docker.io/falcosecurity/falco:0.39.0

核心参数说明

  • --privileged — 内核事件采集必需（高权限）
  • falco_rules.yaml — 自定义检测规则
  • 输出 — stdout/Slack/Prometheus
  • 部署 — K8s DaemonSet 为主

Latest tags (20)

View all 415 tags →
TagArchPushed AtSizeDigestSyncWishAction
docker.io/falcosecurity/falco
:master-debian
linux/arm64linux/amd64
2026/06/17 16:3982.5 MBsha256:489b9133016f…
docker.io/falcosecurity/falco
:master
linux/arm64linux/amd64
2026/06/17 16:3945.5 MBsha256:4892ffd26de9…
docker.io/falcosecurity/falco
:x86_64-master-debian
linux/amd64
2026/06/17 16:3787.0 MBsha256:2821098dc9c5…
docker.io/falcosecurity/falco
:aarch64-master-debian
linux/arm64
2026/06/17 16:3682.5 MBsha256:489b9133016f…
docker.io/falcosecurity/falco
:x86_64-master
linux/amd64
2026/06/17 16:3648.1 MBsha256:39ef8d17dbd9…
docker.io/falcosecurity/falco
:aarch64-master
linux/arm64
2026/06/17 16:3645.5 MBsha256:4892ffd26de9…
docker.io/falcosecurity/falco
:latest-debian
linux/arm64linux/amd64
2026/06/11 16:2582.7 MBsha256:e41dbf170a23…
docker.io/falcosecurity/falco
:latest
linux/arm64linux/amd64
2026/06/11 16:2545.4 MBsha256:8f90cf02a84b…
docker.io/falcosecurity/falco
:0.44.1-debian
linux/arm64linux/amd64
2026/06/11 16:2482.7 MBsha256:e41dbf170a23…
docker.io/falcosecurity/falco
:0.44.1
linux/arm64linux/amd64
2026/06/11 16:2445.4 MBsha256:8f90cf02a84b…
docker.io/falcosecurity/falco
:x86_64-0.44.1-debian
linux/amd64
2026/06/11 16:2287.2 MBsha256:278c60bbcb13…
docker.io/falcosecurity/falco
:aarch64-0.44.1-debian
linux/arm64
2026/06/11 16:2282.7 MBsha256:e41dbf170a23…
docker.io/falcosecurity/falco
:x86_64-0.44.1
linux/amd64
2026/06/11 16:2247.9 MBsha256:9f02feb5544a…
docker.io/falcosecurity/falco
:aarch64-0.44.1
linux/arm64
2026/06/11 16:2245.4 MBsha256:8f90cf02a84b…
docker.io/falcosecurity/falco
:0.44.1-rc1-debian
linux/arm64linux/amd64
2026/06/10 17:3982.7 MBsha256:90e2b99f2fa7…
docker.io/falcosecurity/falco
:0.44.1-rc1
linux/arm64linux/amd64
2026/06/10 17:3945.4 MBsha256:d2a8e1a004ee…
docker.io/falcosecurity/falco
:x86_64-0.44.1-rc1-debian
linux/amd64
2026/06/10 17:3787.2 MBsha256:e1aded5db354…
docker.io/falcosecurity/falco
:aarch64-0.44.1-rc1-debian
linux/arm64
2026/06/10 17:3782.7 MBsha256:90e2b99f2fa7…
docker.io/falcosecurity/falco
:x86_64-0.44.1-rc1
linux/amd64
2026/06/10 17:3747.9 MBsha256:4ba1c9f8b687…
docker.io/falcosecurity/falco
:aarch64-0.44.1-rc1
linux/arm64
2026/06/10 17:3745.4 MBsha256:d2a8e1a004ee…