Falco容器逃逸检测
原名：detecting-container-escape-with-falco-rules
编写并调优 Falco 规则，通过监控 Linux 系统调用实时检测容器逃逸行为，包括主机文件系统挂载、敏感路径访问、内核模块加载及特权能力滥用。适用于 Kubernetes 环境部署、调优或调查相关告警。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 2
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-09-07
- TRACE 评分
- 3 / 5
内容概览
Falco is a CNCF-graduated runtime security tool that monitors Linux syscalls to detect anomalous container behavior. It uses a rules engine to identify container escape techniques such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities. - When investigating security incidents that require detecting container escape with falco rules - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques - Linux host with kernel 5.8+ (for eBPF driver) or kernel module support - Kubernetes cluster (v1.24+) or standalone Docker/containerd - Helm 3 for Kubernetes deployment - Root or privileged access for driver installation 1. Deploy Falco as DaemonSet to ensure …