You are viewing documentation for Falco version: v0.34.1

Falco v0.34.1 documentation is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date documentation, see the latest version.

Download

Officially supported Falco artifacts

The Falco Project community only supports two ways for downloading and running Falco:

  • Running Falco directly on a Linux host
  • Running the Falco userspace program in a container, with a driver installed on the underlying host.

Below you can find artifacts for both.

Download for Linux

developmentstable
rpmrpm-devrpm
debdeb-devdeb
binarybin-devbin

The list of all available artifacts can be found here.

Download container images

Falco depends on having a driver installed on the host system to get information about the running system calls.

The preferred installation method is to install the driver using the native artifacts defined above or temporarily run the falcosecurity/falco-driver-loader image as privileged, then using the falcosecurity/falco-no-driver.

For more details, see the Run within Docker section.

tagpull commanddescription
latestdocker pull falcosecurity/falco-no-driver:latestThe most recent version
versiondocker pull falcosecurity/falco-no-driver:<version>A specific version of Falco such as 0.34.1
latestdocker pull falcosecurity/falco-driver-loader:latestThe most recent version of falco-driver-loader with the building toolchain
versiondocker pull falcosecurity/falco-driver-loader:<version>A specific version of falco-driver-loader such as 0.34.1 with the building toolchain
latestdocker pull falcosecurity/falco:latestThe most recent version with the falco-driver-loader included
versiondocker pull falcosecurity/falco:<version>A specific version of Falco such as 0.34.1 with falco-driver-loader included

The list of all available images can be found here.